Whether you're focusing on creating and maintaining content on Wikipedia, or expressly interested in patrolling recent changes, or even regardless of whether you're a new or experienced user, chances are good that at some point you will probably run across a vandal. This tutorial aims to give you the knowledge and tools to appropriately deal with this situation, when it arises. I highly recommend you skim over this, rather than reading everything at once.

This probably seems like a silly question, but it's an important one. Wikipedia policy defines vandalism as "any addition, removal, or change of content made in a deliberate attempt to compromise the integrity of Wikipedia." Vandalism is always disruptive, but not all disruptive changes fit into the narrow category we call "vandalism." This distinction can become very important: many users accidentally treat content disputes as vandalism; doing so can muddy the waters in important discussions, could get you into trouble, and generally causes hot heads all around.

As a general rule of thumb: if you can assume good faith, try and do so. There's no deadline.

Identifying vandalism is of course an essential element of dealing with it, and there's no end to the list of tools available: if you regularly edit some articles, be sure and add them to your watchlist; you can watch recent changes for edits which add or remove large amounts of text, or are otherwise suspect -- anonymous users (recognized by an IP address in place of a user name) or users with redlinked user and talk pages tend to be new, for example; other resources include Wikipedia:Most vandalized pages (WP:MVP).

If you're interested in learning more about the available tools (it's a bit beyond the scope of this tutorial), Wikipedia:Recent changes patrol is a decent place to start.

So, you've run into an edit, and you're pretty sure it's vandalism -- what now? Ideally you can consider each incident on a case-by-case basis, but if you're looking to get a feel for things, I recommend a progression something like the following. Don't worry too much about getting it perfect, the important part is that you boldly lend a helping hand in good faith.

In brief: revert, warn, check, report.

This is usually the first and most important step, when responding to vandalism. There are a few ways to handle this; Help:Reverting contains a pretty useful guide. I'll run over the basics, here.

When looking at a diff, you'll see an older version of the page on the left, and a newer version on the right. You may notice the "undo" button next to the newer edit. If there was only one problem edit, and page hasn't been edited much since that edit, this is a quick solution. Undo has the advantage of frequently working even if the page has since been edited productively.

In cases with multiple problem edits, you can navigate back through a few diffs and make use of your ability to edit old versions of a page -- "edit" the last good version of the page, and simply save it with no changes (most user scripts use something akin to this method, when reverting). If there are good edits made after the bad edits, be careful and try to retain or restore the good work.

If you find yourself reverting vandals on any regular basis, you will probably want to install some user scripts (more on this, below). Around the time I started writing this, Wikipedia:Requests for rollback went live, allowing experienced users to request access to a very easy, fast, one-click method for reverting top-edit vandalism that had previously been limited to administrators -- see Wikipedia:Rollback feature. Review of this process is slated to take place just before this is scheduled for publishing.

Template warnings are quick and easy to use. It's good to place these at the bottom of a user's talk page. There's a more comprehensive list at Wikipedia:Template messages/User talk namespace (WP:WARN); generally, though, these work in most situations:

• {{subst:uw-test1}} (assume good faith, maybe they're just testing)
• {{subst:uw-test2}} ("heeeeey, please knock it off")
• {{subst:uw-test3}} (more stern, start thinking about reporting if they keep up)
• {{subst:uw-test4}} (final warning, report if vandalism continues beyond this point)

Substing is good, but not important. If you can't remember the "uw-" bit, just using {{test1}} to {{test4}} will work fine, too.

Some vandals are really trying to damage our work, but for the most part they're usually new and curious ("I can really edit this? Cool!") or don't understand what we're about. Getting angry or frustrated rarely solves the problem, and is liable to provoke further problems. It's difficult to strike a perfect balance between assuming good faith, discouraging attention-seekers, and preventing disruption, but the current suite of warning templates does a pretty amicable job of that. Some situations may call for you to "jump up the ladder" and start issuing serious warnings more quickly, but it's rarely a bad idea to start from the bottom and work your way up, one at a time.

Remember, also, that you can also write out messages by hand. Not as quick, but easy to remember and tailor-made for the situation at hand!

This step, fortunately, can be pretty easy. If you haven't already, check the page you fixed to be sure you didn't accidentally introduce new problems or revert to a bad version.

A common problem shared by the pages with both extremely high and extremely low traffic is that several vandals edit the page one right after another (sometimes with occasional decent editors in between). Therefore it is always a good idea to check the recent history of the vandalized page for suspicious user names and strange edits.

Often a vandal (or a curious fingerpoker) edits several pages. It is easy to check their other edits by following the link to the user's contributions from the history tab.

A decent portion of the time, it will eventually become clear that somebody isn't just "trying things out," or that they haven't realized they should stop, or that they're earnestly trying to deal some damage to the project. Around this time, it's a good idea to get the attention of administrators, who have a variety of tools to deal with vandalism.

• Wikipedia:Administrator intervention against vandalism (WP:AIV) is usually your first port of call, especially in cases involving a single person or small group.
• Wikipedia:Requests for page protection (WP:RFPP) can also be useful in cases involving several people, quickly changing IP addresses, sockpuppets, or multiple pages.
• When in doubt, Wikipedia:Administrators' noticeboard/Incidents (WP:ANI) is a quick way to get admin attention for any number of issues.

Development on a variety of tools to monitor and resolve vandalism is ongoing; going into too much detail is likely to render this tutorial severely dated. As of this writing, user scripts like Twinkle or Lupin's anti-vandal tool are popular options, and integrate easily with regular browsing. Other up-to-date resources are listed at Wikipedia:Recent changes patrol#Tools.

• Wikipedia:Administrator intervention against vandalism
• Wikipedia:Requests for page protection
• Wikipedia:Recent changes patrol
• Wikipedia:Template messages/User talk namespace (shortcut: WP:WARN)
• Wikipedia:The motivation of a vandal