Hot answers tagged

7

Akismet - libraries: First I want to mention that there are many Akismet libraries out there: http://akismet.com/development/ and here are the API documents: http://akismet.com/development/api/ Akismet - WordPress plugin: But as I understand it, you want to use the Akismet WordPress plugin as your library. The following code snippet is a simple proof ...


6

You don't need a form to submit a comment to the wp-comments-post.php file, or to send a pingback or trackback. Spammers don't use forms, they simply send their spam directly. Removing the form doesn't "turn off" comments. To do that, go to the Posts screen, and use the Quick Edit to actually disable comments and trackbacks for the various posts. Also visit ...


5

I won't repeat any of the good advice in Squish's answer. You should also read this article on Wordpress security. I'm just going to cover the specifics of what I learned from my episode. My attack is a kind of black hat SEO known as "hideMeYa": http://siteolytics.com/black-hat-seo-technique-demystified/ Basically, the attacker slips a bunch of hidden ...


5

That table is from the redirection plugin, and isn't a part of WordPress Core. Deleting it should have no ill effects as long as you disable the plugin too. If you wish to continue using that plugin though, I recommend using the plugin authors support at https://wordpress.org/support/plugin/redirection/


4

In order to add a new comment you really only need a couple of fields and a POST method. In a typical comment form, requests are submitted to http://www.example.com/wp-comments-post.php which parses the $_POST data and sends it off to wp_handle_comment_submission. A POST method varies from a GET request in that params are usually sent in a non-visual way. ...


4

There is definitely a performance advantage in keeping your comment spam to a minimum. If you have a lot of comments, the query time can get pretty out of control. To make it easier, you should install Akismet if you haven't already. Akismet will automatically detect spam comments and move them to WordPress spam section. You can then delete all the spam ...


4

If you don't want people filling website field, simply remove it from the form. Put this code in functions.php of your current theme: function wpse_remove_comment_url($fields) { unset($fields['url']); return $fields; } add_filter('comment_form_default_fields', 'wpse_remove_comment_url'); It is more logical than showing the field and advising users ...


4

This is a LOG table. It logs 404 errors - requests that Redirection could not resolve. The proper way to shrink the table is: change the setting "time to keep logs for" to something shorter than "Forever". Navigate to WP Dashboard / Tools / Redirection / Options / 404 Logs. Choose one of: No logs A day A week A month Two months The next time Redirection ...


3

From WordPress point of view the most vulnerable part is resource–intensive loading of WordPress core and page generation. So for a primitive attack your priority is to never let these reach WP core. That would mean intercepting them at some stage before at web server, reverse proxy, or firewall level. Depends on server stack and configuration options ...


3

First of all, report whoever is doing it. You obviously could block anything with a query-string that contains screw-you, but that'll only help in this case. Maybe Drop any requests with HTTP/1.0 (browser don't use it, and "good" bots like google don't either, but if you need to provide access to special tools, you might not want to do this), but you ...


3

I also use Akismet but rarely does a spam comment get thru. This is what i do. 1. If you remove the website url field from your comment form, you'll find this will reduce both automated and manual spam comments as spammers are only interested in leaving links. You can do this by installing a plugin or using code. 2. I also removed the comment form allowed ...


3

Just install a good anti-spam plugin. They will monitors site's comments for spam and automatically blocks spam comments. BTW WordPress come with Akismet which is a spam protection plugin installed by default. To enable the plugin, go to the Plugins and activate the Plugin. Akismet Anti-Spam


3

I'd actually recommend that you disable comments for now. I know that as a new user, you are thrilled to get a response but my experience shows that quality comments only come after you have established yourself. In the beginning of your career as a blogger or website owner, it is ususally just tons of spam you get. If you really want to keep the comment ...


3

I think there are two decent options here. Let WordPress keep its mail function, but hook in once or twice wp_mail() has several hooks that will be helpful for you to replace the built in behavior, which is basically to use php's simple little mailer. Here are a couple of those helpful hooks that I think you might use, since that's what you asked for: //...


2

Those characters you quoted here are Han (used by Chinese language), as they matched by the unicode character property \p{Han}. You can perform a regular expression search in a plugin like so: <?php /** * Plugin Name: Drop comments by chars * Description: Delete comments which includes unicode characters of Han, Hangul and Cyrillic. * Version: ...


2

SQL Query DELETE FROM `wp_comments` WHERE `comment_type`="trackback" Run Query from this plugin: wp-dbmanager


2

You can include this code by creating a new custom plugin which help you to stop this when you deactivate the plugin. wp_schedule_event(time(), 'daily', 'my_dailyClearOut'); function my_clearOldUsers() { global $wpdb; $query = $wpdb->prepare("SELECT ID FROM $wpdb->users WHERE datediff(now(), user_registered) > 7"); if ($oldUsers = $...


2

In general, the best place to look is in your theme folders, specifically the main theme and in the index.php file. Then the footer and header files. Also, check your modified dates and start with the most recently modified. Especially if there are several that were all modified around the same date/time. I've seen, and had to fix, this problem several ...


2

If you have access to the server you have some options like using mod_evasive (if using apache2) - this will throttle the requests. It's also worth putting your website on some cache, like WP Super Cache, force preloading of caching and let it serve static files, it will reduce the chances of you bottlenecking.


2

You can use : <?php $blogusers = get_users( 'role=subscriber' ); // Array of WP_User objects. foreach ( $blogusers as $user ) { $user_id = $user->ID; wp_delete_user( $user_id ); }


2

I ended up deleting all users who had not made a post using the following two queries: First: DELETE FROM wp_users WHERE ID NOT IN (SELECT post_author FROM wp_posts) Second: DELETE FROM wp_usermeta WHERE user_id NOT IN (SELECT ID FROM wp_users)


2

Did you try a search from the Posts (Admin) screen? (And also the Pages (Admin) screen? And sometimes a googles of your site might find it: use something like search-term site:example.com ...depends on how current the googles are for your site. But sometimes works well. Added To answer your question/comment: Remember that there is no 'source code' (as ...


2

Thank you so much for your reply. It helped me figure out what's going on. I get a far bit of spam submissions via my contact form, these spam submissions include URLs. Although they are being flagged as spam and filtered out, WordPress still creates an oembed_cache entry in the database for them. I have verified I do not have any actual spam links on my ...


1

Yes. There are a variety of ways to do this, primarily, we'll need to tackle the wp_delete_user() function. Your first task, and the tricky one, is to identity which accounts are spam, and which are real. This can be quite an adventure if your site gains new users regularly. With the following example, we target two values, the user's email account and ...


1

It is better to use 'comment_post' action for this purpose, it is fired when the comment is saved in database: add_action('comment_post', 'my_comment_post_callback', 10, 3); function my_comment_post_callback($comment_id, $comment_approved, $commentdata) { if (strpos($commentdata['comment_content'], 'dog') !== false) { $post_url = get_permalink($...


1

It's possible that the random stuff is not in the database; your answer doesn't make that clear. There could be some modified WP files that are inserting text in each displayed post. Recovering from a hacked system is time-consuming, but can be done. Short list: update WP/themes/plugins to latest versions. Check the htaccess file against a default one. ...


1

Your site is almost definitely compromised. Doing your own cleanup may not be worth the time and effort because reinfection is likely if you miss a single infected file. At this point I recommend to my clients that they get professional help. You may be able to get more details from a site scan by Sucuri. They have a free remote scan for virus infection. ...


1

It can be time-consuming to 'clean' a WP site, but it can be done with dogged determination. You'll need to reinstall WP/plugins/themes, change hosting and FTP and database credentials, look for rouge files, and more. This might help http://securitydawg.com/recovering-from-a-hacked-wordpress-site/ (disclosure: I wrote this after people kept asking me about ...


1

You should be able to back up your site through your hosting control panel. This is a better option than adding bloat to your WP install to duplicate functionality you already have elsewhere.


1

You probably have alot of bots creating the fake usernames/pass. If you're using Buddypress then you will get lots of bots. Try NoMoreCaptchas, it authenticates the user as a human or bot via a new type of technology called BioChronometrics. This is super fast for the user since it is completely passive authentication. It's based on user behavior.


Only top voted, non community-wiki answers of a minimum length are eligible