Tag Info

Hot answers tagged

17

I like to use Honeypots in my forms since the user won't notice them, they keep most crap away but are not 100% foolproof. The trick is to make a new form field in your existing form, for example <input type="text" name="email" id="mailfield"/> and put #mailfield { display: none; } in your CSS. If your form is submitted with data in the email field ...


11

I would recommend you to install and enable Akismet: http://wordpress.org/extend/plugins/akismet/ Akismet checks your comments against the Akismet web service to see if they look like spam or not and lets you review the spam it catches under your blog's "Comments" admin screen.


9

They do this because they can go back later on when the thread is forgotten about (e.g. less likely to be moderated) and switch the image with a spam advertisement. Doing it doesn't require anything more then switching out images on their end so even if you delete the account as long as the post remains they will be successful and with virtually no work on ...


8

Use a combination of timestamp, spinner, field names, and honeypots... Read this article for the detailed example. A timestamp is exactly what it sounds like. A hidden field that marks the time when the form was originally opened. This defeats playback bots that copy a form and replay back the submission process over and over with different data each time. ...


6

Ok here is a very good possibility which you can test out. Since it's a coupon domain they are potentially cookie stuffing your visitors using the hot linked image. How it works is they hot link to an image on their server. And within their own .htaccess rule they create a redirect so when that image is loaded it redirects to an affiliate link, your ...


6

Look into having a honey pot in your form, this will only work though if it's a generic robot, as the moment a custom script is written the honeypot can easily be bypassed. Also, if you're not keen on a CAPTCHA you could try Solve Media's alternative and earn a bit on the side at the same time, I think it was Ticketmaster who recently started using them as ...


5

Various enterprise-level email systems have built in spam filters, things like Google Apps, MS Exchange etc. If you're hosting your own email, you'll have to setup your server with some sort of third-party spam/blacklist software, this will be a bit more complicated and will warrant some further research.


5

There is plenty solutions to expand short url: What is the best way in PHP or JS to expand shortened URLs like Bitly, Tinyurl to find the original URL? ExpandUrl (a java solution) Expand short URL – Simple PHP app for beginners expanding short url to original url using PHP and CURL Simple-URL-Expander (a javascript solution) When user submit a new post, ...


4

What if CSS and javascript is turned off in a browser? A proper honeypot won't rely on either of these to work. Ideally you will use a hidden form field for this which doesn't require any real hiding.. Do you see any other disadvantages in the honey pot trap? If you do it properly there shouldn't be any issues that users will be aware of. There ...


4

A best practice shows the following user friendly solution: Add a hidden field in your form. Bots will automatically complete all forms, whilst humans will not since they cannot see the hidden field. When all fields are submitted you know that its a bot and you simply won't allow submitting a message. Works great and there is no extra hassle for your website ...


3

Fmz, you… kind of inadvertedly advertised, that telescope to me right now. And maybe you searched for it on google, and maybe you visited an online shop that sells it. So I suppose they have a point about that. Not a direct sale, more of a branding thing.


3

It is quite difficult to tell without adding further checks I would normally add a question that a computer can't answer. Ie "If today is Thursday, what is tomorrow?" "What month comes before October?" etc. I use this technique on our forum as well as a Captcha and it has reduced the amount of spam quite considerably. Just having a Captcha wasn't ...


3

is this a feasible/good system for spam prevention? No, for a variety of reasons - chiefly: IP address assignments change over time. Do you want to delete posts from 2011 in the year 2015 because a spammer was assigned an IP which had seen use prior? Malicious flagging happens. Do you want a few malicious posts to interfere with comments from one of ...


3

You should make sure the email address is not only real but in the control of the registrant. Send an email to that address with an activation link inside. Make visiting that link a requirement for activating their account. That way you know the email is both real and in the control of the user. One check you may want to consider making is checking the DNS ...


3

I like low-tech: Doing a simple math problem works well. Enter what 4 + 4 adds up to: Then check server-side for 8. This is one I've used successfully on blogs using the Math Comment Spam Protection Plugin. Adding an extra field to your forms like: <input name="bots_only" value="" style="display: none" /> Usually, if bots_only is passed along ...


3

I would not have used a regex on http:// or https:// but I woudl rather try a solution such as Askimet. It is believed to be pretty good against spam comments. Or maybe Disqus like comments. Can it hurt? When trying to give a point of view, I generally confirm what I say, with a couple of links = yes. But if the progression of spam ratio has fallen, I ...


3

a solution to that is to render the email information encoded, and a javascript function decode them and show them after the page have been load. Nothing hard to code and deocode, a simple one can do the work. Other way is to render your email to an image and show the image. With any trick like that the spammers can not easy read your email to place it on ...


3

You should probably just rate-limit. For example, who generally invites more than 10 friends and family members a day? Give, as google does, a number of invites that gets used up, and then regenerates over time. And reward people who get other people to sign up on the site with more invites, people who send out invites that get no response don't get ...


3

I do not see any big problem but Spamassassin is giving three hints on how to make the email look better: you get 2.5 points for having an image and only a few words. Remove the image or increase the text length you get 1.1 points for your formatting. Your Email is not correct HTML (e.g., is missing the <html> tag you get 1.2 points because you are ...


3

there currently aren't any safeguards in place, and while uncommon people can spam your account, for example, if they hold a grudge. If you are spammed you cannot remove this data. It is best to put in place a precautionary filter, selecting 'include only' and 'traffic from the domains' and setting this to your domain(s) which you want to be included.


3

Google probably won't remove the links on its own, if the links are showing up as coming from your website's pages then you can request that Google Remove them, you can also request links on other pages are removed (but this is a little more complicated). Google has a useful support article on the subject.


3

You can try to obscure the support email address by avoiding common terms like staff@ and support@ while using some variation that is easy to tell customers. This foils low-level spammers that just constantly hit those common addresses on every domain. You can also try to further obscure the email address by using a form that submits mail to the address ...


3

There is no easy way to resolve this issue. I stopped using email all together. I prefer to have all contact done using a main "contact" form on my site. Using emails addresses became extremely frustrating. On the contact form I include a drop down box that includes different departments so users can select where the email should go like "support", ...


3

I would recommend you to use a free captcha service like SweetCaptcha http://wordpress.org/extend/plugins/sweetcaptcha-revolutionary-free-captcha-service/ You can also use an external service to manage your comments like Disqus http://wordpress.org/extend/plugins/disqus-comment-system/


3

Having tried a bunch of different methods in the past, my answer, at least as far as "unspammable" goes, would be "You can't." Even with your image technique, or no matter what else you do, as soon as somebody does e-mail you they'll have your address in their address book. And then they'll get infected by a virus that steals their address book and sends ...


3

The ideal way to do this is to send a hard fail on email that isn't coming from your server IP address or your specified MX record by doing this: v=spf1 +a +mx -all This however will not Stop the email from being sent. Spam filters do various checks on an email that has been sent out, one of them will be a check on the SPF record of the domain it is ...


2

I've also used simple natural language challenges, such as : A ________ is something with numbered pages surrounded by two covers. Hint: Rhymes with look The caveats of this approach is having to maintain a separate challenge/hint/answer file for each language that you want to support, but I'm leaning in this direction more and more as CAPTCHA images ...


2

They can only tell if it's a valid email address if that person has registered with your site, so it all depends on how popular your site gets. I don't think that converting it to camelcase will change anything as they can easily convert to lower case or upper case if necessary. Have you thought of putting a captcha on the site? Google's ReCaptcha is ...


2

I the mail server the client user have a good SPAM filter it should not be a problem. The SPAM will just go into the junk. If you still think that you have to make him remove his email tell him that people will love a simple contact form instead of email. Or lie to him that exposing his address to public makes it vulnerable to hacker attacks. And the most ...



Only top voted, non community-wiki answers of a minimum length are eligible