Sep
18th

Wordpress Comment Spam Hack

MathArrrrgh. I’m so tired of comment spam. It’s not simply that it’s spam, it’s that it’s vulgar and repulsive. I really wish I could sue the butts off of these guys! I’m trying something a little bit different that I noticed in an entry from Seth Godin a long time ago. Since Wordpress has a standard comments package, any spammer can simply post to their hearts content to the comments post file (wp-comments-post.php).

I’ve edited the comments post file to add a problem that requires a correct answer. So, when you try to comment, it’s going to simply ask you to add two numbers together. If you get the answer right, it will work. If you don’t, you’ll get an error.

Here’s how I’ve done it. In your comments post file (wp-comments-post.php), I’ve added a variable at line 25 to be collected from the post:

$comment_addition = trim($_POST['addition']);

And then at line 50 58, I make sure that the response that you post is correct… in this case = 10. Note, this must be entered in the If statement if there is NO userid (after if ( !$user->ID ) :)

if ( ‘10′ != $comment_addition )
die( __(’Error: please try your addition again.’) );

Now I have to add the fields to my theme on my comments page. This takes a little more work because you need to know where the form is on the page. It will look something like this:

<?php if ( !$user_ID ) { ?>
<p><input class="text_input" type="text" name="author" id="author" value="<?php echo $comment_author; ?>" tabindex="1" /><label for="author"><strong>Name</strong></label></p>
<p><input class="text_input" type="text" name="email" id="email" value="<?php echo $comment_author_email; ?>" tabindex="2" /><label for="email"><strong>Mail</strong></label></p>
<p><input class="text_input" type="text" name="url" id="url" value="<?php echo $comment_author_url; ?>" tabindex="3" /><label for="url"><strong>Website</strong></label></p>
<p><input class="text_code" type="text" name="addition" id="addition" value="" tabindex="4" /><label for="addition"><strong>What does 8 + 2 equal?</strong></label></p>
<?php } ?>

Notice the additional form variable that I added, called addition. Now, if someone can’t add… they can’t get their comment added. It’s simple, but effective. On I Choose Indy! I’ve modified it a little, and asked for the area code of Indianapolis. (Hey Pat, I updated yours and tested it as well!).

Here’s why I call it a hack… once a WordPress upgrade comes out, I’m going to have to re-edit those files. I don’t like doing that - but until I can put this into some kind of plugin, that’s the only choice I have. If the spammers get smart enough, I can rename the variable and ask for a different number.

RSS feed | Trackback URI

11 Comments »

Comment by no imageYvonne (SezWho)
2006-09-19 00:47:12

Akismet is the way to go, Doug :D

PS: I wanted to test what would happen if I got the puzzle wrong!

Rate this:
2.9
 
Comment by no imagePatric Welch (SezWho)
2006-09-19 07:48:13

I feel your pain. I switched my comments to moderated only because of the overflow of spam comments I was receiving. Keep me informed if any of the techniques you described here work.
Rate this:
2.8
 
Comment by no imageTechZ (SezWho)
2006-09-19 09:16:28

I use SK2, and BB2, they have kept my blog 100% spam free.
Rate this:
2.9
 
Comment by no imageDouglas Karr (SezWho)
2006-09-21 15:38:34

I did find a bug. If a user was registered, it would still request the challenge answer…even though there was no field to enter it in. Ooops. I’ve modified the entry.
Rate this:
2.9
 
Comment by no imageDouglas Karr (SezWho)
2006-09-23 19:39:26

Still buggy!!! Back to the drawing board on this one. I’m going to work on a plugin instead. Thanks for all the testing and feedback folks!

Doug

Rate this:
2.9
 
Comment by no imageDouglas Karr (SezWho)
2007-01-26 19:14:21

I did modify Ryan’s great contact form plugin so you can ask a challenge question:
WordPress Contact Form plugin with Spam Protection.
Rate this:
2.9
 
Comment by no imageBollywood Movies (SezWho)
2007-03-13 12:04:09

nice dude… will run it on my site.. its simple and elegant
Rate this:
1.6
 
Comment by no imageardamis (SezWho)
2007-09-17 00:52:26

Don’t give up, man. The challenge-response test method is a good start. I’ve written a post on stopping comment spam that involved a challenge question, but also renames the wp-comment-post.php file, hides the URL of the new script in an external JavaScript file, and then only writes the URL to the page if the challenge question is answered correctly.

The full post is at
Defeating WordPress comment spam

Good luck,
-ardamis

Rate this:
1.6
 
2007-10-07 01:30:25

[...] of comments: let me know by E-Mail if you can’t post here. Late last month, I tried adding new form fields to prevent spam posting, combining it with a trick I used on one of my uncle’s websites for this purpose: I added two [...]
 
Comment by no imageSteve (SezWho)
2007-11-10 04:10:25

Have you managed to find a plug-in that will do this for you yet?

I use Akismet and it does a pretty good job - no, I really should say a great job - but some kind of question-response plug-in that worked with Akismet would be almost bullet proof!

Anything that you know of?

Steve

Rate this:
2.9
Comment by no imageDouglas Karr (SezWho)
2007-11-10 12:41:03

Not yet, Steve. The best plugin to thwart comment spam yet appears to be the match challenge question plugin.
Rate this:
2.9
 
 
Name (required)
E-mail (required - never shown publicly)
URI
Your Comment (smaller size | larger size)
You may use <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong> in your comment.

My Comment Policy: I moderate comments. Please be patient:

  • Spam will happily be destroyed.
  • Use your real name, not some keywords. Otherwise it will be destroyed.
  • Mean comments aren't necessary. If I don't post them I will reply personally to let you know why.
  • Lewd comments will be edited, I don't want my readers leaving because of offensive content.
Great debate, criticism and colorful commentary is always appreciated and approved!