3

I've blocked access to xmlrcp, and removed most everything that is generated in wp_head. However, I'm still getting notifications in the admin about comments being posted on posts even when there is no form on that page. How is this possible?

I'm thinking that this below would work:

// Remove comment support
add_action( 'init', function() {
        remove_post_type_support( 'page', 'comments' );
        remove_post_type_support( 'post', 'comments' );

});
// Close open comments
add_filter( 'comments_open', function( $open, $post_id ) {
    $post = get_post( $post_id );
    if ( 'page' == $post->post_type || 'post' == $post->post_type  )
        $open = false;
    return $open;
}, 10, 2 );

However, whether the above works or not, I'm still wondering how someone/ or a spam bot is able to post a comment when there is no form or anything on the page.

  • No actual form is needed to generate a POST request, the spammer just has to know what the fields would be called. – vancoder Mar 21 '16 at 22:59
2

The visual representation of a comment form (or lack of it) do not have any impact on the ability to receive comments, and spammers usually don't care at all what is in your form. Wordpress have a well publicized end point to which all comments are being sent (and while I don't remember the detail off the top of my head right now) and spammers can post to that endpoint with enough details to make a proper comment, without even loading the post to which they comment to.

One of the easy antispam steps against lazy spammers is to add an hidden field to the comment form and discard every comment which is submitted without it.

0

A small trick is checking your current theme and creating a new file comments.php (if you don't have). On this file, you just place this code:

<?php return false; ?>

It will prevent any bot to use your comment form for posting.

  • Seems like a great trick if you want comments disabled all together. But if wanting comments on a particular post type this doesn't seem like it would work. – Bryan Willis Mar 22 '16 at 2:27
  • No, the visual representation of a comment form (or lack of it) do not have any impact on the ability to receive comments, and spammer usually don't care at all what is in your form. – Mark Kaplun Mar 22 '16 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.