skippy dot net

Hey Skippi, thanks for the excellent idea for this plugin. But... I'm having problems installing it; the commentauth.tgz archive includes a single file called commentauth (and no extension). I can't figure out which parts of it belong to which of the two files. Could you perhaps provide the two files in a zip instead of a tgz? It may be the fault of my decompressor (FilZip) handing the tgz archives badly (although it would be the first time it's not working). Thanks in advance!

Installation can't get any easier than this, and it works perfectly. Thanks again for providing the .zip as alternate download!

Indeed, this is not a plugin to fight back spam. It helps real people who post real comments authorise their own messages, so I don't have to manually approve them. This way, the moderation queue should contain only comments with fake e-mail addresses, mostly from spammers. Spammers rarely manually submit messages themselves - that would simply be inefficient. Instead, they rely on specialized computer programs, a specialized form of web spiders, to identify possible targets and automatically submit messages through default settings. Web forums used to be attacked this way - spam bots would find the registration script (the same filename and location for all forums using phpBB or vBulletin, for example) and submit a reply that included all form data required for registration. This way, a bunch of usernames advertising various porn sites were common on most web forums out there. Now, they are targeting WordPress blogs, they only have to submit the same HTTP request for each post to sitename/wp-comments-post.php ; the request has the name, e-mail, url and message filled in. In both cases (forums and WP), the simplest solution to prevent such automatic submissions is to alter the default fields for the submission script. Either rename the submission script, or change the field names, or add a new mandatory field which requires human interaction. The last seems best to me; use a plugin to generate some random text and display it in an image, so only a real person can figure out what the text is and enter it manually. Most bots will not send that field because they don't actually request the page with the form prior to submitting the comments. Very, very few bots do so, and they may include OCR algorithms to find out what the text is - but this can be prevented by using non-standard fonts or adding some random lines to confuse the OCR script. So, if you use such a plugin to block out spam bots, and then rely on another plugin to allow real people with real e-mail addresses to activate their own posts, all you should have left in the moderating queue are spam messages added manually. Voila :)