Title: Reduce comment spam and php processing
Last modified: August 18, 2016

---

# Reduce comment spam and php processing

 *  [Paul](https://wordpress.org/support/users/paulburd/)
 * (@paulburd)
 * [19 years, 10 months ago](https://wordpress.org/support/topic/reduce-comment-spam-and-php-processing/)
 * This enrty isn’t a question. I’m reposting a copy of a blog enrty I wrote in 
   hopes that it may be useful to someone else who is having the same trouble I 
   was. For anyone who is interested, my original post can be found [here](http://www.onedigitallife.com/2006/08/12/wordpress-comment-spam-and-php-processing/).
 * __________________________________
 * This post is slightly about fighting comment spam, but for me, it’s more about
   reducing php processing, and server load. It comes as a result of [my recent trouble](http://www.onedigitallife.com/2006/08/09/moving-one-digital-life-part-iwhy-i-ditched-lunarpages/)
   with my (former) web host.
 * I use the [Akismet](http://akismet.com/) wordpress plugin / service to reduce
   comment spam. It works extremely well. Very rarely does comment spam actually
   get posted to this site.
 * Currently, Akismet prevents about 3,000 spam comments a day from entering my 
   site. Even though the spam never gets posted, every comment is still processed,
   and written to the database, resulting in a [much larger database](http://www.onedigitallife.com/2006/08/07/40000-comment-spams/)
   file and higher server load.
 * Once I realized just how many times a day comments were being written to the 
   database, I began to look for a way to reduce it. The answer was surprisingly
   simple.
 * **How Comments Work:**
 * Lets start with how comments work in WordPress. Inside you theme’s folder, there
   are 2 files, _comments.php_, and _comments-popup.php_ (your theme probably only
   uses one of them). Those are the forms that a visitor to your site fills out 
   when leaving a comment. But, they don’t handle the actual posting of the comment.
   They pass the data to a core wordpress file called _wp-comments-post.php_, which
   in turn processes the comment and writes it to the database.
 * **What I did:**
 * All I did to reduce the amount of comment spam being written to the database 
   was change the name of the file, _wp-comments-post.php_. You can change it to
   whatever you want, like _die-punk-ass-spammers-die.php._ Then open up either 
   _comments.php_, or _comments-popup.php_ (whichever file your theme uses), and
   replace the reference to _wp-comments-post.php_, with the new name of that file.
   That’s it!
 * **In the last 24 hours, instead of 3,000 spam comments being written to the database,
   I only had 64 !**
 * This method is by no means a permanent fix, and it won’t work for everyone. I’ll
   address these issues in just a minute.
 * I didn’t come up with this approach, I found it online. Everywhere that I found
   it, some people said it worked great for them, and others said it didn’t work
   at all. If you think about it, that makes total sense, because it all depends
   on how your site is being attacked.
 * There are two basic ways for spammers to leave comments on your blog:
 * #1 They send out their little spambots to crawl your site, and interact with 
   your comment form.
 * #2 At some point in the past, their spambots crawled your site, determined the
   location of _wp-comments-post.php_, and now they are hitting that file directly…
   bypassing your form all together (this is how I was being attacked).
 * Changing the filename of _wp-comments-post.php_ will do little to nothing for
   option #1. Any half-witted spambot can crawl your site, and interact with your
   comment form. But for option #2, this method can have a dramatic effect, as seen
   by my results.
 * As I mentioned, this method is not a permanent fix. As time goes by, those freakin
   spambots will log the location of your newly renamed file, and begin hitting 
   it directly again. You’ll have to monitor the traffic pattern, and change the
   filename again every so often. I’ve only been doing it for one day, so I can’t
   say how long it will last. As an added layer of protection, I placed a blank 
   file on my server, and gave it the name of the original file, _wp-comments-post.
   php_, in hopes that anyone already hitting that file will not get a 404 error,
   and re-crawl the site. I’m hoping this will extend the longevity of my new file.
 * When looking at this approach, I started wondering if a plugin could be written
   to dynamically rename the file? Are there any wordpress gurus out there willing
   to pick up the challenge?
 * One other thing to keep in mind if you try this approach, is future WordPress
   upgrades. The next time you upgrade, you’ll get a new files called, _wp-comments-
   post.php_. You’ll need to rename that new file when you get it, and ditch your
   current file.

Viewing 5 replies - 1 through 5 (of 5 total)

 *  [yosemite](https://wordpress.org/support/users/yosemite/)
 * (@yosemite)
 * [19 years, 10 months ago](https://wordpress.org/support/topic/reduce-comment-spam-and-php-processing/#post-434160)
 * _This enrty isn’t a question. _
 * You submitted it as a support question.
 * Try Bad Behavior (with Akismet).
 *  [whooami](https://wordpress.org/support/users/whooami/)
 * (@whooami)
 * [19 years, 10 months ago](https://wordpress.org/support/topic/reduce-comment-spam-and-php-processing/#post-434164)
 * if your intent on fighting spam without the use of plugins that are a lot of 
   things you can do in addition to merely renaming wp-comments-post.php
 * 1. Only allow access to wp-comments-post IF the referer is coming from your domain(
   Yes the domain can be spoofed, thats not the point, and 99% of the scripts are
   not going to spoof the referer; theyre not that smart (yet).)
 * 2. rename the variables inside wp-comments-post.php to something other than the
   default ones. You will also need to make adjustments to your themes comments.
   php as that actually does the submitting of the variables based on the default
   fields.
 * 3. Use mod_security (if you have it available) to scan post payloads.
 * theres more yet.. and I’ve blog about those ways extensively on my own site.
 * I recently helped someone that was using 3-4 additional plugins on top of BB 
   to manage spam. Last time i checked he had gotten one spam comment in a week 
   after making some rather simple changes that I reccommended. Without askimet,
   without spam-karma.
 * I get 0 spam, and I use one plugin to manage it: bad behaviour. The rest is all
   my own doing.
 * My comments do go into moderation though, just to be on the safe side.
 *  Thread Starter [Paul](https://wordpress.org/support/users/paulburd/)
 * (@paulburd)
 * [19 years, 10 months ago](https://wordpress.org/support/topic/reduce-comment-spam-and-php-processing/#post-434175)
 * Thanks for the info, whooami. A couple of questions…
 * 1. Does Bad Behavior prevent the spam from being written to the databse (not 
   just prevent it from being posted), and does it add much additional php processing?
 * 2. Can you provide more information on limiting access to my domain only?
 * Thanks.
 *  [whooami](https://wordpress.org/support/users/whooami/)
 * (@whooami)
 * [19 years, 10 months ago](https://wordpress.org/support/topic/reduce-comment-spam-and-php-processing/#post-434176)
 * 1. Yes, and no, not really. least not that I notice.
 * 2. yes, do this, in your .htaccess:
 * `RewriteCond %{HTTP_REFERER} "!^http://www.domain.com/.*$" [NC]`
    `RewriteCond%{
   REQUEST_URI} ".*commentwhatever.php$"` `RewriteRule .* - [F]`
 * where domain.com is your domain name and where commentwhatever.php is the name
   of the file youve renamed.
 *  Thread Starter [Paul](https://wordpress.org/support/users/paulburd/)
 * (@paulburd)
 * [19 years, 10 months ago](https://wordpress.org/support/topic/reduce-comment-spam-and-php-processing/#post-434188)
 * very cool, thanks! I’lll give that a try.

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Reduce comment spam and php processing’ is closed to new replies.

## Tags

 * [database](https://wordpress.org/support/topic-tag/database/)
 * [wp-comments-post.php](https://wordpress.org/support/topic-tag/wp-comments-post-php/)

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 5 replies
 * 3 participants
 * Last reply from: [Paul](https://wordpress.org/support/users/paulburd/)
 * Last activity: [19 years, 10 months ago](https://wordpress.org/support/topic/reduce-comment-spam-and-php-processing/#post-434188)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics