{"id":106,"date":"2006-05-24T23:06:06","date_gmt":"2006-05-25T07:06:06","guid":{"rendered":"http:\/\/outflux.net\/blog\/archives\/2006\/05\/24\/easy-wordpress-anti-spam\/"},"modified":"2006-05-25T07:29:35","modified_gmt":"2006-05-25T15:29:35","slug":"easy-wordpress-anti-spam","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2006\/05\/24\/easy-wordpress-anti-spam\/","title":{"rendered":"easy wordpress anti-spam"},"content":{"rendered":"<p>After getting about 40 moderation requests a day, I figured I should spend some time finding some anti-comment-spam plugins for <a href=\"http:\/\/codex.wordpress.org\/\">WordPress<\/a>.  After digging around a while, I found one that doesn&#8217;t require JavaScript, doesn&#8217;t perform vision tests, but works just fine for the kind of comment-spam-bot that seemed to have taken a liking to my blog (even though no spam ever appeared in my comments ever&#8230;)<\/p>\n<p>I found <a href=\"http:\/\/wp-plugins.net\/plugin\/lr2Spam\/\">lr2Spam<\/a> which has a great setup, but an incomplete final step.  I merged it with ideas I saw in the <a href=\"http:\/\/weblog.sinteur.com\/index.php?p=8106\">RBL measures<\/a> <a href=\"http:\/\/svn.wp-plugins.org\/dns-anti-spam\/trunk\/\">plugin<\/a>, and got some good results.  By replacing lr2Spam&#8217;s <code>comment_post<\/code> with <code>pre_comment_content<\/code> (see the WordPress <a href=\"http:\/\/codex.wordpress.org\/Plugin_API\">Plugin API<\/a>), I was able to redirect spammers away from from my site with PHP&#8217;s <code>header(\"Location: [URL]\")<\/code> technique.  (This is what I borrowed from the RBL plugin.)  The <a href=\"http:\/\/outflux.net\/software\/patches\/lr2spam.patch\">patch<\/a> is almost as big as lr2Spam itself (both are very small).  Honestly, I&#8217;m surprised it works at all.  Someone wrote a comment-spam bot that can&#8217;t correctly parse a totally valid HTML form, but does correctly handle a 302\/Location redirect.  Weird.<\/p>\n<p>I thought briefly about redirecting all the spammers to http:\/\/fbi.gov\/i-am-a-spammer\/?ip=[IP] but then realized their requests&#8217; referer header would show my URL still.  On further thought, I realized that comment-spam is very different from email spam because the bot has to implement a much larger set of protocol elements.  Since they must respect the 302\/Location redirect, someone who is getting hit really hard with comment spam could effectively DDoS somone&#8217;s link by redirecting to somewhere with big files.  Say, for example, instead of using fbi.gov above, I used http:\/\/mirrors.example.com\/iso\/DVD-distro-image.iso.  Every spam bot in their network would start a giant-ass download from example.com after hitting my anti-spam system.  Ewww.<\/p>\n<p>Implemented early on May 20th, after 4 days, I&#8217;ve seen 250 comment spam attempts from 162 unique IP addresses (most in China &#8212; maybe they need to turn their firewall around).  The volume of spam isn&#8217;t big when compared to my daily <a href=\"http:\/\/outflux.net\/spam\/graphs\/rejected.png\">email spam statistics<\/a>, but each one of those would have been an email in my inbox, asking for moderation.  Interestingly, they all stopped on May 23rd.  Maybe they got a clue.<\/p>\n<p style='text-align:left'>&copy; 2006, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>After getting about 40 moderation requests a day, I figured I should spend some time finding some anti-comment-spam plugins for WordPress. After digging around a while, I found one that doesn&#8217;t require JavaScript, doesn&#8217;t perform vision tests, but works just fine for the kind of comment-spam-bot that seemed to have taken a liking to my [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,7,6],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/106"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=106"}],"version-history":[{"count":0,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/106\/revisions"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=106"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=106"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}