0

I could not find a definitive answer on this so I figured I would ask here.

I am using Elelmentor Pro forms to make a contact form, but it is getting form spam bot submissions. I have reCaptcha installed but they are getting past it. In looking at the server logs I can see that the bot is making a direct POST to admin-ajax.php to submit the form.

I am wondering if there is any reason for admin-ajax.php to be available to anyone via direct access? If the point of the file is to allow the website to asynchronously post data why would it even be allowed to be accessed directly, especially from an ip that is not the ip of the site itself?

Would I break things if I blocked all ips that are not my site ip from POSTing to admin-ajax.php?

1 Answer 1

2

If the point of the file is to allow the website to asynchronously post data why would it even be allowed to be accessed directly, especially from an ip that is not the ip of the site itself?

AJAX requests come from the user's IP address, not the site's, because an AJAX request is by definition a request made by the user's browser.

Would I break things if I blocked all ips that are not my site ip from POSTing to admin-ajax.php?

Yes, you would break all AJAX requests that use admin-ajax.php, including those used by WordPress core.

I have reCaptcha installed but they are getting past it.

If reCAPTCHA is implemented correctly these direct requests should fail because the server should be validating the CAPTCHA on the server. If you've implemented reCAPTCHA yourself you need to make sure this server-side validation is occurring. If you didn't, then you will need to raise this issue with the developer of the plugin you're using.

2
  • Thanks, I did some tests and figured out that the request comes from the user's server. Duh, a moment of stupid on my part to not realize that. As far as implementing reCaptcha, it is implemented properly, but reCaptcha is not infallible, and it would be folly to think it was. It both has false positives and false negatives. Spammers can be smart and are finding was past it all the time. I decided to write my own bot detector and it is working nicely. Because F**k Google anyways.
    – pathfinder
    Jul 19, 2023 at 16:48
  • I don't think you're right about reCAPTCHA. Getting around a reCAPTCHA on the page is one thing, but if they're POSTing directly to admin-ajax.php then they should not be able to POST a valid challenge and response, and the request should fail if they are not provided. Are you sure these are being validated server-side? Jul 20, 2023 at 7:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.