0

I've done a bunch of searching but can't seem to find a hack to do this, all I can find is how to remove the website field from the form. I want to leave it there, but if someone enters a url into the website field and tries to post a comment, it will automatically be rejected.

  • 1
    Are you using that field for another purpose? It seems to be silly to show that field, but not allow any entry in that field. If you don't want people to fill out the field, don't show it .. remove it from the form. If you need an additional field on the comment form, there are ways to do that. Me = confused. – Rick Hellewell Oct 9 '18 at 0:01
  • Then spam comments will still come through even if I remove the url field. – Steve Halcovitch Oct 9 '18 at 0:23
  • Then why keep the URL box at all? Remove it, and then you'll know that if the website field contains something it isn't because a user accidentally filled it – Tom J Nowell Oct 9 '18 at 0:25
  • My comments are being filled with spam even with Akismet. If I simply remove the url field the spam comments are still going to get through with or without a url. I just need a script that only allows comments through that don't have a url entered, that will solve my spam problem once and for all. – Steve Halcovitch Oct 9 '18 at 0:49
  • Spam problems will not go away if you ban URLs from comments. I know a lot about preventing spam in contact forms and comments; wrote a plugin and standalone code to prevent form spam (see FormSpammerTrap.com ). My techniques are mostly successful, but still get some spam. Got a new version in the works that will reduce automated spam even more. You might think about enabling reCAPTCHA on your comment forms. That helps reduce spam, but nothing that I've found (and I've looked for many years) will completely remove spam. – Rick Hellewell Oct 9 '18 at 3:04
0

Figured this out by editing the max url string length in comment.php from 200 to 1. Only problem is any wordpress update will overwrite this each time. How would I go about making this change in functions instead?

0

If you think that limiting URLs will block all spam, nope. Most spam is automated: the spammer finds your comment form, creates an automated form-filler, then fills in the comment with their spam.

So xpam problems will not go away if you ban URLs from comments.

I know a lot about preventing spam in contact forms and comments; wrote a plugin and standalone code to prevent form spam (see [here][1] ). My techniques are mostly successful, but still get some spam. Got a new version in the works that will reduce automated spam even more.

You might think about enabling reCAPTCHA on your comment forms. That helps reduce spam, but nothing that I've found (and I've looked for many years) will completely remove spam.

Hidden fields don't work. "Questions" like "what is 2 + 4" don't work. Captchas don't work (although the version 2 ReCaptcha is more effective).

My practice is to enable Akismet, and use my "FormSpammerTrap for Comments" plugin (which has some additional techniques to reduce the chance that a spam-bot will fill out my comment).

That helps get rid of a lot of comments. But nothing is 100% effective - not even my solutions.

  • Modern spammers don't care about comment forms at all. They post comment's data directly, bypassing form's processing, with its validation, captchas, etc. Read my answer for details. – Frank P. Walentynowicz Oct 9 '18 at 7:20
0

Analysis

The most common misconception is, that modern spammers use comment forms. They don't care about them, at all. They post comment's data directly, bypassing form's processing, with its validation, captcha, etc, leaving comment forms to legitimate users (humans). In a process of detection comments spam, two players take part - WordPress, and a supplementing plugin. With correct settings, WordPress is pretty successful in catching spam, but cannot catch them all. The plugin should further refine the process.

Solution

The following method, implemented on my various production websites, for years, made them virtually spam-free. You might be skeptical, so don't take my word for it, just try it, and make your own judgement.

Part 1. WordPress

In Settings -> Discussion set these suggested options:

Check Allow people to post comments on new articles box

Check Comment author must fill out name and email box

Check Comment must be manually approved box

Set the value of Hold a comment in the queue if it contains to 1

Play with other options according to your needs.

Part 2. Must use plugin

Make a file fpw-antispam.php, with code below, and place it in /wp-content/mu-plugins folder.

<?php
/*
Plugin Name: FPW Anti Spam

Description: Handles spammed comments and disables comments trash

Plugin URI: http://fw2s.com/
Version: 0.1
Author: Frank P. Walentynowicz
Author URI: http://fw2s.com/

Copyright 2014 Frank P. Walentynowicz (email : frankpw@fw2s.com)

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License, version 2, as 
published by the Free Software Foundation.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
*/

// prevent direct access
if (!defined('ABSPATH'))  
    die('Direct access to this script is not allowed!');

function fpwDeleteComment($commentID, $approved, $commentData) {
    if('trash' === $approved || 'spam' === $approved) {
        $requestedBy = (empty($commentData['comment_author_url'])) ? 'WordPress' : 'must use plugin';
        if(wp_delete_comment($commentID, true)) {
            error_log("Comment ({$commentID}) has been PERMANENTLY DELETED by {$requestedBy}");
        } else {
            error_log("Comment ({$commentID}) - delete failed");
        }
    } else {
        error_log("Comment ({$commentID}) - status: {$approved}");
    }   
}
add_action('comment_post', 'fpwDeleteComment', 100, 3);

function fpwDeleteTrashedComment($commentID, $commentObject) {
    if(wp_delete_comment($commentID, true)) {
        error_log("Comment ({$commentID}) has been TRASHED and PERMANENTLY DELETED");
    } else {
        error_log("Comment ({$commentID}) - delete failed");
    }
}
add_action('comment_trash_', 'fpwDeleteTrashedComment', 100, 2);

function fpwCommentHandler($approved , $commentdata) {
    return empty($commentdata['comment_author_url']) ? $approved : 'trash';
}
add_filter('pre_comment_approved' , 'fpwCommentHandler' , 100, 2);

Note: error_log function calls help you to trace, unobtrusively, the progress of the plugin. Once you become confident that it works as expected, you can comment out these calls.

Part 3. CSS

Add the following line to style.css of your current theme:

p.comment-form-url { display: none }

This will hide author's URL field from human users, only, so they cannot, accidentally, fill out this field. Remember to leave comment's template intact - do not remove this field!

UPDATE

Because it worked so well, I didn't even look back to do any changes to the method above. After posting my answer, I've decided to see, if any improvement is possible. The final result follows.

Must use plugin is reduced to one filter only, and most important change is, that spammed comments are dropped, without any access to the database.

function fpwCommentHandler($approved , $commentdata) {
    if (!empty($commentdata['comment_author_url']) || 'spam' == $approved || 'trash' == $approved)
        return new WP_Error( 'spam', 'Comment spam detected!');
    return $approved;
}
add_filter('pre_comment_approved' , 'fpwCommentHandler' , 100, 2);

Note: if you don't feel comfortable, to use it as is (without logging), you can add logging, on your own. I've implemented this new method on my production websites, already.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.