Effective Spam Protection for a WordPress Blog

I get around 10–30 comments every day, most of them spam (90%), and I’m really fed up with it! Akismet doesn’t help: it lets spam through like a sieve, and sometimes even marks legitimate comments as spam! Overall, it works terribly!

I also tried other WordPress plugins that used a shared database of spammers or set cookies. The first one’s database was buggy; the second one wouldn’t set cookies!

The other day, Oleg Grigoryev aka vasa_c started fighting spammers and wrote an article called DIY Anti-Spam. Only after that did I decide to start fighting spammers too, and I finally found spam protection that works! Now no spam messages get through to the blog—not a single one!

So what’s the secret? Let’s get started…

Theory

In theory, we simply rename the regular form fields, create fake fields for spambots, and hide them so that only spambots can fill them in, while a human won’t see them. Then we check: if the fake fields have been filled in, we mark the comments as spam or don’t add them at all!

In theory, this works for any website, but now I’ll go into more detail about the practical side as it applies to WordPress!

Practice

Editing the WordPress theme

Edit the form in your WordPress theme (the comments.php file):

1. Rename the “email input” from “email” to “WoRd1”
2. Create a new “input” and name it “email”
3. Rename the “textarea” named “comment” to “WorD2”

<form action="/wp-comments-post.php" method="post" id="commentform"> 

    <input    name="author" id="author" tabindex="1" /> 
    <input    name="email"  id="emailh" /> 
    <input    name="WoRd1"  id="email"  tabindex="2" /> 
    <input    name="url"    id="url"    tabindex="3" /> 
    <textarea name="WoRd2"  id="comment" cols="100%" rows="10" tabindex="4"></textarea>

    <input    name="submit" type="submit" tabindex="5" value="Отправить" /> 
    <input    name="comment_post_ID" type="hidden" value="775" /> 

</form>

Instead of “WoRd1” and “WoRd2”, use your own names if possible!

Now we need to hide the fake input “email” that we created, but not with type=hidden, since bots might notice that. Instead, hide it using a CSS style (that’s harder for bots; they’re unlikely to bother).

#emailh { display: none; }

Editing the comment handler

Next, open the wp-comments-post.php file and add code at the very beginning of the file to process the fields we created and changed.

<?php
/**
 * Handles Comment Post to WordPress and prevents duplicate comment posting.
 *
 * @package WordPress
 */

// Подменяем comment (textarea)
$_POST['comment'] = $_POST['WoRd2'];

// Подменяем email и если заполнено поле "email", помечаем "автора" как "author_name [SPAM]".
// Тут вы можете вызвать return; или exit; например!
$_POST['author'] = empty($_POST['email']) ? $_POST['author'] : $_POST['author'].' [SPAM]';
$_POST['email'] = $_POST['WoRd1'];

That’s it—our anti-spam protection is ready!

I tested this solution for 3 days: NOT A SINGLE SPAM COMMENT!

upd: After 1 month and 7 days, still NOT A SINGLE SPAM COMMENT!
upd: After 1 year and 1 day, still NOT A SINGLE SPAM COMMENT!