Comment spam via wp-comments-post.php

I run a site which has comments enabled, but we use wpDiscuz (a plugin which provides enhancements to the built-in WP comments system, it doesn’t replace it).

However, my problem isn’t with that plugin, but with wp-comments-post.php — wpDiscuz routes comments via admin-ajax.php, so it doesn’t use wp-comments-post.php.

We’ve recently been getting a lot of comment spam submitted directly to wp-comments-post.php which somehow is ending up on the site, mostly “binance” sign-up spam.

Here is an example of the POSTed data (I have removed the referral ID and obscured the email address):

Array (
    [comment] => Thanks for sharing. I read many of your blog posts, cool, your blog is very good. https://www.binance.com/de-CH/register?ref=xxxxxx
    [author] => für binance anmelden
    [email] => [email protected]
    [url] => https://www.binance.com/de-CH/register?ref=xxxxxx
    [submit] => Post Comment
    [comment_post_ID] => 13073
    [comment_parent] => 0
)

I already added “binance” to the “Disallowed Comment Keys” list — but that didn’t work.

As our site’s comment form doesn’t have the website/URL field, we know that any comments which have anything in the URL field must be spam.

So I also wrote a PHP function which hooks into the comment approval process. Note that I also check for “binance” here, even though it should be caught by the WP system already:

add_filter( 'pre_comment_approved', function($approved, $commentdata) {

	// If the comment URL field has anything in it, mark as spam
	if ( ! empty( $commentdata['comment_author_url'] ) ) $approved = 'spam';

	// If the comment contains 'binance' then mark as spam
	if ( str_contains( $commentdata['comment_content'], 'binance' ) ) $approved = 'spam';

	return $approved;

}, 10, 2);

From my investigations, I can’t see anywhere that wpDiscuz is interfering with these hooks, or indeed any of the WP built-in comments system.

For now I’ve just blocked access to wp-comments-post.php in .htaccess, so nobody can get to it!

But I thought it might be worth raising the issue here — how are these comments getting past the built-in WordPress spam blocking, which should be able to block comments containing specific strings?