So, you’ve found some vandalism or spam, and researched other edits by the same user account to see if there’s more. The next, and important, step is to post an appropriate warning on the editor’s user talk page.
The primary purpose of a warning about vandalism or spam, perhaps counter-intuitively, is not to get the problem editor to change her ways. (It would be nice if she did so, but troublemakers aren’t likely to reform themselves just because someone asked nicely.) Rather, when you and other editors post a series of increasingly strong warnings, you’re building a documented case for blocking a user account from further disruptive editing. If the warnings lead to a change of behavior of the editor before blocking is necessary, great—but don’t hold your breath.
Start by looking at the warnings that have already been posted on the user talk page, if any. Then take a look at the history tab for the user talk page: the editor might have deleted warnings by other editors.
Note
There’s much confusion as to whether editors are allowed to remove warnings from their user talk pages. They are. Deletion is considered to be confirmation that the warnings have been read, and the warnings remain visible via the “history” tab. For details, see the “Removal of comments, warnings” section of the guideline Wikipedia:User page (shortcut: WP:USER). So you must check the user talk page’s history to see if prior warnings were deleted, but don’t revert those warnings so that other editors can see them on the user talk page.
You’ll find a table of warnings at Wikipedia:Template messages/User talk namespace (shortcut: WP:WARN). Warnings to editors come in levels 1 through 4:
Level 1. Assumes good faith. Generally includes Welcome to Wikipedia or some variant.
Level 2. No faith assumption.
Level 3. Assumes bad faith; cease and desist.
Level 4. Assumes bad faith; strong cease and desist, last warning (this level of warning must be preceded by at least one prior warning).
Level 4im. Assumes bad faith; strong cease and desist, first and only warning.
From the warning table, pick an appropriate warning at the level you’ve chosen. Picking the appropriate level of warning is an art, not a science. Here are some general guidelines:
You don’t have to start at level 1, nor do you have to escalate if the editor seems to have generally behaved after getting a prior warning, but you should always post some level of warning, or a note, when you find a recent problem.
If you’re not sure about what level of warning to post, pick one, post it (as described in the next section), and do a page preview. If the wording doesn’t seem to fit, go up or down a level and see what that looks like.
For example, assume that you found vandalism, and that a level 2 warning had already been posted for that same type of vandalism. You should post a level 3, or, if you just found a lot, perhaps even a level 4 warning.
If there already was a level 4 (final warning), you can normally skip directly to the next step—asking an administrator to block the user account (see General Guidance on Blocking Vandals).
Exception: If the most recent vandalism or spam by a user account is older than 48 hours, administrators don’t usually put a block in place. Blocks are preventive, not punitive. So if you find old vandalism and a prior level 4 warning, it may be helpful to post another “final warning” as a note to other editors not to give this user account any leeway in the future.
Once you’ve selected an appropriate warning template, posting it is a quick six-step process. (If you’re not dealing with a real situation, you can still practice this procedure by posting to your own user talk page. Just don’t click “Save page”. Instead, in the last step, stop after doing the preview.)
On Wikipedia:Template messages/User talk namespace (shortcut: WP:WARN), copy the text of the template warning to the clipboard (Ctrl+C on Windows; ⌘-C on Mac).
This step is optional, but may save you time later. Or you may want to use the clipboard for something else, like the name of the page where the problem edit occurred.
On the user talk page where you want to post the warning, click the “+” tab at the top to start a new topic. You’re in edit mode, with a new section visible for you to edit.
In the subject line, type Warning or something more specific like Warning – your edit to [[Name of article]].
It’s important to use neutral language here. Your primary goal is to provide information to other editors, not to chastise someone you think is a vandal. If you get personal (expressing emotion, and/or commenting on the editor as a person), you run a serious risk of either biting a newcomer (see WP:BITE for details) or feeding a troll (see WP:DENY and WP:DIV for details).
In the body of the new topic posting, paste (or type) the template, with {{subst: at the front and }} at the end, followed by tildes for your signature (for more on signing your comments, see Identifying Yourself).
For example: {{subst:uw-vandalism3}} ~~~~
Click “Show preview” to make sure everything worked as expected (see Figure 7-5).
If everything looks okay, then click “Save page”.
It’s generally not worth posting a warning in these cases:
If a shared IP address (like that of a university or library) has been blocked at least five times within the past 6 months or so. Instead, report the problem at Wikipedia:Abuse reports (shortcut: WP:ABUSE). The user talk page usually indicates whether an IP address is shared. Another way to tell is that with a shared IP address, the length of time for each block doesn’t increase over time, or doesn’t increase significantly.
If you find older vandalism, and the editor’s already been warned. Adding a warning is appropriate only when a new type of problem arises, or when someone has ignored a prior warning and continued some improper behavior.
If the user received a level 4/4im, last/final warning, and vandalized after that. Just request the user be blocked, as described on General Guidance on Blocking Vandals.
If an anonymous IP address vandalized only a single page, on a single occasion (including consecutive edits), and has never done any other editing. Here you’re dealing with a hit-and-run vandal. It’s highly unlikely the vandal will reappear with that IP address, so nobody’s going to read any warning you post, and there’s no point in laying down an initial warning for other editors to build on.
Wikipedia has a well-known saying: “Don’t template the regulars.” As discussed on ???, someone who has a long history of constructive edits isn’t likely to have done a vandalizing or spamming edit. If it looks like she did, you should double-check and triple-check before proceeding. And if you do conclude that her edit looks non-constructive and revert it, don’t use a warning template to post a message: Write something more personal. (For example, you might post something like I’m not sure I understood [Diff_url this edit that you did], I reverted it because it looked like a mistake; please let me know if I missed something.)