Spam problems? (solution1)
-
Ok i just installed two fresh WordPress (1.3) blogs and without announcing them to whomever, i got casino spam out of nowhere (although notices of posts are send to pingomatic.com as per options/writing)
A simple solution is to alter the post-form-process by editing two lines in two php files. This will definitely make spam-comment-bot’s life uneasy ??
Bots tend to post data and not submit a form, so… generate a unique name for author and email fieldnames which get checked at post time.
wp-comments-post.php (version 1.3 around line 20)
change the fieldnames
// we made unique field names in the form.
$authorfieldname = md5( date('ymdh') . DB_USER );
$emailfieldname = md5( date('ymdh') . DB_USER . 'M');
$author = trim(strip_tags($_POST[$authorfieldname]));
$email = trim(strip_tags($_POST[$emailfieldname]));
in wp-comments.php (version 1.3 around line 39)
<?php
// ANTI SPAMBOT HACK, VERSION: BRUTE-FORCE 1.0
// make unique fieldnames. checked in wp-comments-post.php
// comment within the hour :-)
$authorfieldname = md5( date('ymdh') . DB_USER );
$emailfieldname = md5( date('ymdh') . DB_USER . 'M');
?>
in the html form substitue author and email fieldname with”
<input type="text" name="<?php echo $authorfieldname;?> id="author"
and further down
<input type="text" name="<?php echo $emailfieldname;?> id="email"
This way every blog (by means of md5 hash of DB_USER) has a unique identifier and blatantly posting data to wp-comments-post.php without the correct fieldnames results in nothing ??
I hate this spam-o-matic-bots hitting an, even un-announced, blog. I made this hack because i didn’t think this even can be done with a plugin. This can be made more robust with session cookie (not preferred) or with a javascript-generated-hidden-tag-on-post. When possible i would like to see this in 1.3stable
Success WP team…
Tr909
- The topic ‘Spam problems? (solution1)’ is closed to new replies.