6 ms·

From http://codex.wordpress.org/Comments_in_WordPress http://codex.wordpress.org/Comments_in_WordPress Depending on your site's settings, comments display slig

by OGC 13y ago

From http://codex.wordpress.org/Comments_in_WordPress http://codex.wordpress.org/Comments_in_WordPress Depending on your site's settings, comments display slightly differently from site to site. The basic comment form includes: Name Email Website Comment

YokoZar 13y ago
I have the website field turned off -- it's not visible if you are a real user using the form, and "website" doesn't show up next to comments. But I still get a lot of spam containing the website field; it seems like the bot is just automatically submitting POST requests with website included. This should be trivial to detect -- is there a plugin that just immediately deletes all of these out of hand before passing them on to an antispam tool?
- csmattryder 13y ago
  There's a way of setting the 'hidden' property on an input field and checking if the field is blank. If it's a bot sending POST requests, there's a high chance a "Website:" field would be filled out. Innocent users will not be able to fill out the field, in the case of a legitimate comment.
  - jroakes 13y ago
    This is called a honeypot field. Basically spam bots are stupid and try to fill in every field (especially ones with phone, email, website, etc in the name). The honeypot is a hidden field that if filled out causes the form to not submit completely. There are some plugins for Wordpress that handle this for contact forms (Contact Form 7) and for comment forms. If you search Honeypot from the WordPress plugin directory, you will find them. Also, many spammers hit the wp-comments-post.php file directly. Since they hit it directly there is no referrer passed like there would be if a POST was sent to it from a page on your site. This page: http://goo.gl/n5VHm http://goo.gl/n5VHm on WordPress.com has information on code that can be added to your .htaccess file that will crush bots that POST to wp-comments-post.php with no referrer present.

by OGC 13y ago

YokoZar 13y ago

I have the website field turned off -- it's not visible if you are a real user using the form, and "website" doesn't show up next to comments. But I still get a lot of spam containing the website field; it seems like the bot is just automatically submitting POST requests with website included. This should be trivial to detect -- is there a plugin that just immediately deletes all of these out of hand before passing them on to an antispam tool?

csmattryder 13y ago
There's a way of setting the 'hidden' property on an input field and checking if the field is blank. If it's a bot sending POST requests, there's a high chance a "Website:" field would be filled out. Innocent users will not be able to fill out the field, in the case of a legitimate comment.
- jroakes 13y ago
  This is called a honeypot field. Basically spam bots are stupid and try to fill in every field (especially ones with phone, email, website, etc in the name). The honeypot is a hidden field that if filled out causes the form to not submit completely. There are some plugins for Wordpress that handle this for contact forms (Contact Form 7) and for comment forms. If you search Honeypot from the WordPress plugin directory, you will find them. Also, many spammers hit the wp-comments-post.php file directly. Since they hit it directly there is no referrer passed like there would be if a POST was sent to it from a page on your site. This page: http://goo.gl/n5VHm http://goo.gl/n5VHm on WordPress.com has information on code that can be added to your .htaccess file that will crush bots that POST to wp-comments-post.php with no referrer present.