WP-Spamkit - a Wordpress Anti-Spam Plugin
Idea - To Use Response tokens to Reject Comment Spam
A filter available to webmasters is to add a hidden session token or hash function to their comment form. When the comments are submitted, data stored within the posting such as IP address and time of posting can be compared to the data stored with the session token or hash generated when the user loaded the comment form.
Postings that use different IP addresses for loading the comment form and posting the comment form, or postings that took unusually short or long periods of time to compose can be filtered out.
This method is particularly effective against spammers who spoof their IP Address in an attempt to conceal their identities. It works very well against automated bots that send $_POST data to the wp-comments-post.php script. It needs no communication to external servers like Akismet or Bad-Behaviour does!. It would be great if the Wordpress Maintainers implimented a rejection of POSTING DIRECTLY to this file in the core code.
** This Plugin Requires $_SESSION use to be enabled**
** Works better with Javascript Enabled by Clients **
All instructions are within the readme file and there is detailed inline commenting of the WP-Spamkit scripts
Installation
- Copy folder files into your plugins directory
- Ensure the tmp logging folder is writable
- Note: Not needed for WP version>2.2.3 On Windows-Apache Servers you need to make sure you are running the below wordpress patch
- To Work the Activation/Deactivation requires Patch for plugins.php
- Revision 5928 for windows activation of plugins in subfolders is already patched in Wordpress-2.2.3
- In plugins.php
/*replace the function*/
function plugin_basename($file) {
$file = preg_replace('|\\\\+|', '\\\\', $file);
$file = preg_replace('/^.*wp-content[\\\\\/]plugins[\\\\\/]/’, ”, $file);
return $file;
}
/*With Revision 5928 function*/
function plugin_basename($file) {
$file = str_replace(’\\’,’/’,$file);
$file = preg_replace(’|/+|’,’/’, $file);
$file = preg_replace(’|^.*/wp-content/plugins/|’,”,$file);
return $file;
}
- Activate the plugin and then go to the Options page and check your WP-Spamkit settings
- **NOTE: a file-hack to Reject direct $_POST to wp-comments-post.php**
Note: this is not a requirement for the plugin to function but it is a final block to spammers which will stop direct posting to the wp-comments-post.php file and thus bypassing all the WP-Spamkit checks In your wp-comments-post.php replace..
require( dirname(__FILE__) . '/wp-config.php' );
with
@session_start();
require( dirname(__FILE__) . '/wp-config.php' );
// Protect against bypassing the WP-Spamkit Plugin
// with spambot's direct POST to this file
if ($_POST[$_SESSION["rand_name"]] == ”){
// will be no false rejections as a SESSION had to be
// SET during form display we are not worried about
// checking time range or validity of the token
// we Could Enable Logging here but it would be cosmetic
wp_die( __(’Sorry, Spam Comments are rejected at this site.’) );
}
Uninstall
- Deactivate the WP-Spamkit plugin
- Delete the WP-Spamkit plugin folder and files in your plugins directory
- Remove any edits made to the wp-comments-post.php file during installation
Background
The plugin creates a randomly named session variable which is filled with a string of the $_SERVER['REMOTE_ADDR'] and time() encrypted with a seed string set by the admin.
This is then placed into the comment form as a human-hidden field.
The hidden field is checked against the $_SESSION var on posting the comment to see if…
- it is a valid token
- that the form was submitted after the Plugin Adminitrator set minimum time delay
- that the form was submitted before the Plugin Administrator set maximum time expired
Any comments that fail any of these three tests are rejected!.
No moderation is required and there will be no false positives!
BUT NOTE: Javascript is required in the newest version 0.0.8!
To assist real people posting comments after the minimum time delay
a javascript function is used to disable the submit button until the time expires.
Note: WP-Spamkit does not monitor Trackbacks or Pingbacks!!!
Based on the Old SpamKit Plugin
Old SpamKit Plugin URI: Wordpress SpamKitPlugin v1.4
[by Michael Cutler]
Old SpamKit Description: Prototype, uses Time-Based-Tokens in the comment form
[by Gerard Calderhead].
These links do not seem to be alive anymore (they both used to be hosted at the same server IP-address)
Download
Wordpress Plugin: WP-Spamkit 0.0.1
Version: 0.0.8 is available and working VERY, VERY WELL! Not one automated comment-spam has made it through in over 12mths.
If you (are a human and) are interested in Getting the latest Implimented Production version (0.0.8), aside: so far No-One but spammers seem to visit this page, leave a comment and I will Update the Download but there is no need to give the spammers a leg up by providing the download if no-one else wants it.