If you’ve got a WordPress site, you’re probably getting a pretty decent share of incoming spam comments. They can be incredibly annoying and, in some cases, extremely time consuming to deal with. While spam attacks can never truly be 100% stopped, they can be slowed down to a trickle. This presentation will show you how to combat spam directly by getting hands on with several plugins as well as your core WordPress configuration. This presentation was exported from Deckset. That means the funny animated GIFs are just static and boring. Sorry about that!

2. HEY THERE.
I'M JASON COSPER.
@boogah

3. I'M THE SENIOR TECHNOLOGY
ADVISOR AT WP ENGINE.

4. THAT MEANS I GET TO PLAY WITH WORDPRESS FOR A LIVING.

5. I ALSO SPEND a lot OF TIME
ANALYZING & NEUTRALIZING
SECURITY THREATS.

6. IF YOU ASK MY WIFE,
PROBABLY TOO MUCH TIME.

7. BUT IT'S REALLY FUN.
TO ME, AT LEAST.

8. ANYWAY.

9. LET'S TALK ABOUT SPAM.

10. IT'S THE WORST,
RIGHT?

11. Comment spam is a fact of life if you
have a blog.

12. THAT IS A QUOTE LIFTED DIRECTLY
FROM THE CODEX.

13. ONE OF THE BIGGEST REFERENCE LIBRARIES OF
ALL THINGS WORDPRESS.

14. YOU'D BE SURPRISED HOW FEW PEOPLE
HAVE TAKEN THE TIME TO SET UP ANTI-SPAM COUNTERMEASURES.

15. AS WORDPRESS CONTINUES TO GROW INTO A MORE ROBUST CMS,
LESS PEOPLE USE IT TO, YOU KNOW, BLOG.

16. BUT THAT DOESN'T REMOVE THE BLOG FUNCTIONALITY.
OR THE ABILITY TO MAKE COMMENTS.
BOTH OF THOSE THINGS ARE STILL IN WORDPRESS CORE.

17. AND GUESS WHAT?
SPAMMERS ARE itching TO LEAVE THEIR CRUD
ALL OVER YOUR SITE.

18. BUT THERE'S VERY LITTLE BUILT INTO
WORDPRESS TO BATTLE SPAM.

19. THAT'S NOT A BAD THING.
A LEAN WORDPRESS INSTALL IS A HAPPY WORDPRESS INSTALL.

20. FORTUNATELY, YOU CAN GAIN A LOT OF GROUND
WITH A FEW SIMPLE CONFIG TWEAKS.

21. BUT FIRST,
LET ME ASK YOU A QUESTION.

22. ARE COMMENTS EVEN WORTH IT?

23. OF COURSE! IF YOU HAVE A TRADITIONAL BLOG OR COMMUNITY SITE, THAT IS.

24. SO HOW CAN YOU BATTLE SPAM
WITH A STOCK INSTALL?

25. DISCUSSION
SETTINGS!

26. FIRST: Pingbacks & Trackbacks

27. TRACKBACKS WERE CREATED
roughly 12 years ago
TO PROMOTE CONVERSATIONS BETWEEN WEBSITES.

28. IT WAS A NICE WAY TO SAY
"Your post inspired me to write one of my own.
Here's the URL."

29. BUT THERE WAS NO
VERIFICATION.

30. YOU KNOW WHO LOVES
THINGS THAT DON'T REQUIRE
VERIFICATION?

31. SPAMMERS.

32. PINGBACKS ADDED A VERIFICATION PROCESS TO COMBAT THIS.
BUT THAT DOESN'T MEAN THAT PINGBACKS CAN'T BE SPOOFED.

33. IF I HAD A NICKEL FOR EVERY SPOOFED PINGBACK I'VE RECEIVED
I COULD AFFORD A BETTER IDIOM.

34. THIS MIGHT BE A
CONTROVERSIAL OPINION BUT...

35. PINGBACKS & TRACKBACKS ARE BULLSHIT.

36. THAT'S WHY I
DISABLE THEM.

37. 1. UNCHECK "ALLOW LINK NOTIFICATIONS FROM OTHER BLOGS".

38. 2. DROP THIS CODE INTO YOUR MYSQL CLIENT OF CHOICE.
UPDATE wp_posts SET ping_status='closed' WHERE post_status = 'publish' AND post_type = 'post';
UPDATE wp_posts SET ping_status='closed' WHERE post_status = 'publish' AND post_type = 'page';
OR DOWNLOAD Simple Trackback Disabler AND RUN IT.

39. SECOND: Other comment settings

40. THE WORDPRESS DEFAULT IS TO CLOSE COMMENTS ON POSTS AFTER 14 DAYS.
BUT THAT CAN BE LIMITING.

41. MAYBE THAT'S WHY THAT SETTING NEEDS TO BE ENABLED
MANUALLY.

42. I FIND 30 DAYS TO BE A HAPPY MEDIUM.

43. YOU DON'T have to ENABLE
THIS IF YOU HAVE OLDER
POSTS WITH ACTIVE
CONVERSATIONS.

44. BUT IT HELPS.

45. THIRD: Comment Blacklist

46. THIS IS the MOST
OVERLOOKED SPAM FIGHTING
TOOL IN WORDPRESS.

47. PROBABLY BECAUSE CREATING & MANAGING
A BLACKLIST CAN BE TIME CONSUMING.

48. WHAT IF I TOLD YOU THERE WAS A SHORTCUT?

49. THAT'S WHERE THE WORDPRESS COMMENT BLACKLIST COMES IN.
HTTP://COSPER.ME/COMMENT-BLACKLIST

50. 141KB OF BEAUTY.
AND IT KEEPS GETTING BIGGER & BETTER.

51. IT BLOCKS...
1. Spam keywords
2. Spam URLs
3. URL shorteners
4. Non-English comments

52. ALL YOU HAVE TO DO IS COPY & PASTE IT.

53. IF WORDPRESS FINDS A MATCH,
THE COMMENT GOES TO SPAM.

54. THESE KEYWORDS PROCESS before AKISMET.
THAT MEANS LESS EXTERNAL API CALLS.

55. AND YOU CAN CUSTOMIZE IT TO YOUR HEART'S CONTENT!

56. NEED TO ALLOW A URL SHORTENER?
REMOVE IT FROM THE BLACKLIST!

57. CONVERSE IN THAI?
GET RID OF THOSE CHARACTERS!

58. I'VE SEEN FOLKS HAVE A
SIGNIFICANT DROP-OFF IN
SPAM USING just THIS
BLACKLIST.

59. BUT YOU SHOULD STILL USE
AKISMET.

60. WHY AKISMET? DOESN'T IT, YOU KNOW, COST MONEY?

61. IF YOU'VE EVER DEALT WITH A SPAM RUN,
YOU KNOW HOW crazy town banana pants
IT CAN BE.

62. IS YOUR SANITY WORTH
$5 A MONTH?

63. MINE'S WORTH A LOT MORE THAN THAT.
YOURS SHOULD BE TOO.

64. AKISMET'S TRUE POWER LIES IN THE
NUMBER OF SITES IT'S ACTIVE ON.

65. THE MORE PEOPLE RUNNING AKISMET
THE MORE SPAM IT SEES.

66. THE MORE SPAM AKISMET SEES
THE BETTER IT GETS.

67. GETTING AKISMET SET UP USED TO BE
SORT OF A PAIN.

68. AKISMET 3.0 MADE SETUP
stupid EASY.

69. JUST ACTIVATE THE PLUGIN.
IT'S INSTALLED BY DEFAULT WITH WORDPRESS.

70. THEN, GET AN API KEY FOR YOUR SITE.

71. ONCE AKISMET HAS AN API KEY...

72. SET IT UP TO DISCARD THE VERY WORST SPAM.

73. AKISMET HANDLES SPAM SUBMITTED THROUGH...
1. Comment forms
2. Contact forms
3. BuddyPress
4. bbPress

74. THAT'S COOL AND ALL
BUT WHAT ABOUT SPAM USER REGISTRATIONS?

75. IF YOU RUN AN OPEN MULTISITE, BUDDYPRESS OR BBPRESS SITE
SPAM USER REGISTRATIONS ARE PROBABLY THE BANE OF YOUR EXISTENCE.

76. THERE ARE A COUPLE great PLUGINS THAT FILTER
SPAM USER REGISTRATIONS...
▸ WangGuard
▸ Anti-Splog

77. BUT THERE'S ONE THAT I LIKE MORE.

78. AVH FIRST DEFENSE AGAINST SPAM!
THAT NAME IS KIND OF A MOUTHFUL, I KNOW.

79. AVH DEPENDS ON WIDELY USED, TOTALLY FREE ANTI-SPAM BLACKLISTS.
▸ Stop Forum Spam
▸ Project Honey Pot
▸ Spamhaus

80. THESE BLACKLISTS ARE NORMALLY
LEVERAGED BY FORUM & EMAIL
ADMINISTRATORS.

81. MOST SPAM COMES FROM
THE SAME PLACE.
NO OFFENSE, CHINA.

82. AVH ALSO HAS THE ADDED BENEFIT OF
TOTALLY BLOCKING TRAFFIC FROM
BLACKLISTED IP ADDRESSES.
GTFO, SPAMMERS.

83. HEADS UP! HOSTS THAT CACHE heavily DON'T PLAY NICELY WITH AVH.
A NUMBER OF MANAGED HOSTS LEVERAGE SOME OF THESE BLACKLISTS AT THE SERVER LEVEL.

84. TO GET THIS WORKING YOU HAVE TO REGISTER FOR API KEYS FOR TWO OF THE THREE SERVICES.

85. REGISTER FOR STOP FORUM SPAM AT
HTTP://COSPER.ME/SFS-SIGNUP

86. REGISTER FOR PROJECT HONEY POT AT
HTTP://COSPER.ME/PHP-SIGNUP

87. ALL OF THE DEFAULT THRESHOLDS IN AVH ARE FINE.
JUST MAKE SURE TO ENABLE ALL 3 SERVICES IN 3RD PARTY OPTIONS.

88. OH! DON'T FORGET TO ENABLE THE COMMENT NONCE!
YOU CAN FIND THIS IN AVH'S GENERAL OPTIONS.

89. WHY REQUIRE A NONCE?

90. A NONCE IS LIKE A SELF DESTRUCTING KEY.
IF YOU DON'T HAVE ONE — OR YOU HAVE AN OLD ONE — YOU CAN'T GET IN.
OR, IN THIS STRAINED METAPHOR, SUBMIT A COMMENT.

91. THIS MEANS BOTS HITTING WP-COMMENTS-POST.PHP DIRECTLY
WILL GET FLAGGED AS SPAM.

92. HONESTLY, NOBODY REALLY needs TO HIT WP-COMMENTS-POST.PHP DIRECTLY.
EXCEPT FOR DISQUS OR FACEBOOK COMMENTS. BUT WE'RE NOT TALKING ABOUT THEM RIGHT NOW.

93. OKAY. ENOUGH ABOUT SPAM.
WHAT IF AVH DOESN'T WORK ON YOUR HOST?

94. LOOK INTO A
HOSTED WAF! (WEB APPLICATION FIREWALL)

95. JUST LIKE MANAGED HOSTS FOCUS ON JUST WORDPRESS.
HOSTED WAF PRODUCTS CONCENTRATE ON MITIGATING RISKS AND DOS PROTECTION.

96. THE MOST FAMOUS HOSTED WAF SOLUTION IS CLOUDFLARE.
BUT BOTH SUCURI CLOUDPROXY AND INCAPSULA ARE JUST AS GOOD.
AND A BIT MORE FOCUSED ON SECURITY RATHER THAN SPEED.

97. SPOILER ALERT! ALL OF THESE COMPANIES CHARGE FOR WAF SERVICE.

98. THEY'RE totally WORTH IT THOUGH.
SO FIND THE ONE THAT'S RIGHT FOR YOU AND PAY FOR IT!

99. YOU'LL SEE LESS SPAM,
LESS FAKE REGISTRATIONS,
LESS LOGIN ATTEMPTS.

100. SPEAKING OF LOGIN ATTEMPTS...

101. YOU SHOULD DEFINITELY INSTALL LIMIT LOGIN ATTEMPTS
HTTP://COSPER.ME/LLA-PLUGIN

102. A LOT OF HOSTS ARE ADDING IT TO THEIR
INSTALLS BY DEFAULT.
WP ENGINE DOES!

103. THE DEFAULT SETTINGS ARE okay
BUT I PREFER TO salt the earth INSTEAD.

104. OKAY. I THINK THAT'S MY TIME.

105. QUESTIONS? @boogah