Combating Comment Spam in WordPress
I share the same pain as Paul Chaney. Ever since I started my blog on 10/1, I have been getting a ton comment spams.
In the beginning I just turned on comment approval in WordPress so no spam is posted, however, I was getting so much spam it became a huge hassle to go through them.
Since I run my own server, I figure I might just be able to block the IPs the spammers are coming from. A little analysis of the Apache access log showed that the spammers were spoofing all kinds of IPs, so IP blocking is out.
However, further investigation showed that the spammers were using the same set of Name and E-mail (required fields for my blog) when posting spam. Knowing that, I’ve decided to do a bit of code modification to WordPress to combat these spammers. (Another advantage of running your own web server is the ability to modify the code.)
Here’s the code snippet that I added to wp-comments-post.php to block known spammers:
if ($email == 'lilo@suddenenlightenment.us' || $email == 'spammers@yousuck.org')
die( __('Sorry, comments are closed for this item.') );
Obviously you can be a bit more creative when it comes to the message you send to spammers.
Since the modification, I have gotten very few spams.
Adam Kalsey has written a Comment Spam Manifesto that’s worth reading.