Ok, commenting is effectively disabled, so this morning there are 15 trackback spam links…

Just in case anyone wondered what ‘they’ do next, and yes, for the moment Trackback has been disabled (if it turns out to be an exploit rather than a real Trackback, then it’ll be back on again once it’s patched).

Given that I have always tried as hard as I can to make browsing my site (in all its incarnations) as similar as possible in both the latest standards compliant browser(s) as well as lynx/links (without resorting to browser idents, thankyouverymuch) it’s with regret that I now announce that I’ve added JavaScript to my site, and you’ll not be able to leave a comment without it being enabled

For some unknown reason, denying every single spam comment and throwing the IP’s into a banned list just doesn’t stop them – they (the bots, or possibly the spammers) are just so dumb they keep trying. And trying. And trying. And trying. Over 450 in 48 hours is more than I’m willing to put up with, when the commenting is only really there for my own vanity anyway…

So, after using Spam Stopgap Extreme with success for Nicci, I’ve added the latest incarnation wp-hashcash to mine.

For some reason, visitors to this site seem to love clicking on one or more smiley faces and then sending it as a comment. I’ve no idea why, except perhaps that they feel my site doesn’t have enough images, but if you’d like to have a little more information to go on before deciding to approve/decline the comment then adding the following lines to wp-comments-post.php will help.

Basically, the poster has to put something in one of the three fields besides the comment for it to be considered for approval – no it’s not foolproof, but I’d like to see at least a name to go on before deciding if the icon-only post is relevant, or the result of some random clickage)

For WordPress 1.2, add these lines after line 44 (or, more helpfully, after the line that says die( __('Error: please type a comment.') );

if (('' == $email) && ('' == $author) && ('' == $url))
        die( __('Error: please enter more than just your comment.') );

Comment moderation is handy, but it’s annoying from a non-spammers point of view when it appears that the submission has simply vanished. My solution is to add an extra function to wp-includes/template-function-comments.php and a couple of lines in the wp-comments.php file that show a placeholder for pending comments with the time and date of submission (to help prevent abuse such as links in place of a user name there is nothing shown that was typed by the commenter).

Add the following function to wp-includes/template-function-comments.php:

function comment_approved() {
    global $comment;
    return ($comment->comment_approved);
}

Then change the line that fetches the comments in wp-comments.php to fetch all comments regardless of status:

$comments = $wpdb->get_results("SELECT * FROM $tablecomments WHERE
    comment_post_ID = '$id'
    ORDER BY comment_date");

and finally change the main comment display loop to output a placeholder message:

<?php foreach ($comments as $comment) { ?>
    <li id="comment-<?php comment_ID() ?>">
    <?php if (comment_approved() == 1) { comment_text() ?>
        <p><cite><?php comment_type(); ?> <?php _e("by"); ?>
        <?php comment_author_link() ?> &#8212; <?php comment_date() ?>
        @ <a href="#comment-<?php comment_ID() ?>">
        <?php comment_time() ?></a></cite>
        <?php edit_comment_link(__("Edit This"), ' |'); ?></p>
    <?php } else { ?>
        [Comment pending approval]
        <p><cite><?php comment_type(); ?> &#8212; <?php comment_date() ?>
        @ <a href="#comment-<?php comment_ID() ?>">
        <?php comment_time() ?></a></cite>
    <?php } ?>
    </li>
<?php } // end for each comment ?>