How to stop direct HTTP POST to a PHP script?

Question

I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to themes/<themename>/<filename>.php

We have been receiving a lot of spam, it seems that someone can handcraft the form and use it to send spam. In the processing script I check the HTTP_REFERRER, HTTP_SERVER to see if the request came in via our site, but those headers can also be manually crafted in. What steps do I need to undertake to stop the spam coming in?

Help is appreciated.

EDIT : Some more clarity. CF7 will POST the form data to my script at http://www.example.com/wp-content/themes/themename/script.php , that script is accessible . Someone can go to the page where my form is and copy the HTML, re-create the form on their local machine and start submitting the form to my script. How do I stop that?

Answer 1

You must hook the form using wpcf7_before_send_mail and add your PHP code to functions.php (since the script is already in your theme folder)? You won't lose any of CF7's abilities.

function wpse_process_form( &WPCF7Object ){
  #process your form here
}

add_action('wpcf7_before_send_mail', 'wpse_process_form' );

Answer 2

If you are looking for a solution that will detect spam without blocking legitimate users then Use akismet. There is simply no sure technical way to detect spam without inspecting the content itself. smart spammer will even load your page before sending the form.

The only technical solution that might work is to block IP ranges if you can identify the IPs from which you are getting most of the spam. You can also try to block known "bad" IPs by using project honeypot.

Answer 3

even I faced this problem. This is what I finally did.

1. Change the POST processing script's file name.
2. In your forms, keep a hidden form element which is a dummy element, if this is being filled, then its a spammer!! So in your POST processing script, check if this dummy element is being posted - if it is, then its a spammer.