I would like to implement a solution for fighting comment spam and the approach is simple. I would like that every comment that has the "website" field filled to be automatically marked as spam.

In addition, a small warning should be displayed before or after submission telling the user that his message will be marked as spam if he uses the "website" field. < This is not mandatory

What would be the best approach in order to accomplish that?

  • This is not enough to fight comments spam. – Frank P. Walentynowicz Nov 13 '17 at 9:17
  • 2
    This sounds like a bad user experience. There are other "honeypot" approaches, using hidden fields, that don't affect the normal user. – birgire Nov 13 '17 at 9:27
  • @FrankP.Walentynowicz Didn't ask for an "enough solution" to fight spam but for the best approach to implement my idea. – Catherine Anderson Nov 13 '17 at 12:21
  • @birgire Having 50 real comments and 50k spam while none of the real ones had a website filled I have come to the conclusion that a warning message would be enough to avoid a "bad user experience". If someone really wants to leave a message and really needs to fill the website, it will see the hopefully red warning message telling him not to use a website when submitting a comment. If I find a valid comment with a website profile filled I would remove it anyways so here's why I need this the way I need it. :) – Catherine Anderson Nov 13 '17 at 12:26

If you don't want people filling website field, simply remove it from the form. Put this code in functions.php of your current theme:

function wpse_remove_comment_url($fields) { 
    return $fields;
add_filter('comment_form_default_fields', 'wpse_remove_comment_url');

It is more logical than showing the field and advising users against using it.


To not confuse users, and fool some bots, let's make url field invisible to users, and readable to bots. Add this to style.css:

p.comment-form-url { display: none }

Check url field on submission, if it is not empty, you have possible spam comment. Why possible? Because, today's, more sophisticated bots, can scan CSS, and JS scripts, to avoid traps. At least, this is a starting point.

  • 1
    up voted @Frank's answer for common sense. he is right that showing the field and advising users against using it – DHL17 Nov 13 '17 at 9:16
  • 1
    Well, I have to disagree with both of you. Removing the field from the form will not stop bots from submitting comments. I need them to fill the website field so I can use this as a filter in order to mark them as spam. Showing a spam-warning message would give a chance for real users not to fill that field and based on my personal experience with this website I had 50 real comments and 50000 spam. None of the real comments had a website filled so I find my logic perfectly valid. – Catherine Anderson Nov 13 '17 at 12:18
  • 1
    I have to agree with @CatherineAnderson, this do not attempt to actually answer the question. Your answer is basically "Don't do it" which should have probably remained as a comment. – Mark Kaplun Nov 13 '17 at 14:22
  • @CatherineAnderson please, read my updated answer. – Frank P. Walentynowicz Nov 14 '17 at 4:56
  • 1
    @MarkKaplun, that's the idea behind hiding the field. Bots will not parse HTML (some will for nonces) & CSS, and just send the field, thus making it easy to identify them as spam, without any costly content analyses. – janh Nov 14 '17 at 16:14

What you're describing here would be bad UX, there are plenty legitimate users with a website of their own who will want to fill out the website field (like myself).

The honeypot strategy works better when you have a field that a normal user won't see, but bots just looking at the markup will. However it isn't too hard get around that issue.

The best way to fight comment spam is to install Akismet. Akismet is made for this specific task and works wonders at fighting comment spam. OR you could do what nrkbeta.no does, which is to require people to answer a quiz before they're allowed to respond: http://www.niemanlab.org/2017/03/this-site-is-taking-the-edge-off-rant-mode-by-making-readers-pass-a-quiz-before-commenting/

  • Akismet is a crappy plugin which invades the privacy of everyone that comments on the site. Not sure how it is "best" for anything :(. Putting quizes of any type is actually way worse UX than what the OP asks for :( – Mark Kaplun Nov 13 '17 at 14:25
  • Except that the quiz has raised the quality of comments AND people use it without commenting: nrkbeta.no/2017/08/10/… (sadly no english version) – Kristian Kalvå Nov 13 '17 at 15:02
  • if you like to have a quiz on your site, why do you attach it to comments? people hate doing stupid things just to send a form on the web, especially when they are not going to get anything in return to filling the form – Mark Kaplun Nov 13 '17 at 16:08
  • This doesn't answer the question, it's more of a lengthy comment advising against it – Tom J Nowell Nov 13 '17 at 17:16
  • @MarkKaplun Did you read my first link? The reason nrkbeta.no introduced it was to raise the level of comments and debate by requiring the commenter to answer questions relevant to the article before they are allowed to comment. – Kristian Kalvå Nov 14 '17 at 13:33

There's a better way to fight spam. If you look into WooCommerce's source code you can find some code that absolute positions a field off the webpage. Calling it "email_2" so bots think it's some kind of email confirmation. Since bots parse through HTML they will see it but as it's absolute positioned off the screen humans never do. You need to remember to remove it from tab indexing and autocomplete but there are html attributes that do this.

<form action="#" method="post">
  <label>Email Address</label>
  <input type="hidden" name="form_sent" />
  <p><input type="email" class="subscription-email" name="subscripton_email" /></p>
  <p style="left:-999em; position:absolute;"><input type="email" name="email_2" tabindex="-1" autocomplete="off" /></p><!-- Spam trap -->
<p><input type="submit" name="subscription" value="Sign Up" /></p>

This is an example from a plugin I created which implements this idea. Just check if $_POST['email_2'] exists when the form has been submitted. If it's been filled in then it's probably spam.

  • maybe this is a better way, but it do not answer the question, and have only half the code/concept that will make it work. As it is, it is more of a long comment than an answer – Mark Kaplun Nov 13 '17 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.