I am still getting spam from the infamous texas holdem guy; at least I am still 100%. Because with the spamminator killing his manual comments, and the change killing the bots there is nothing else to worry about…for now anyways.

The only ways they could do it would be (1.) to go to your site “by hand” and dig through the code (which I guarantee they won’t do), or (2.) built their spam-sending application to go through your site and automatically figure it out. This is definitely possible, but they probably aren’t going to go through the trouble to write that code since almost no one changes the name of their post page.

But, since it wouldn’t be too difficult for them, and someone may decide to do it if enough people start implementing this fix, there are ways to prevent that from working also.

Based on how their spam posting application works (just going through and submitting a standard WordPress comment post to your posting page directly, rather than loading the page in a browser and clicking through to post a comment), there are still several workarounds you could do to stop this kind of thing.

You could add a hidden form field to the comment form, and make your post page check for that field and disregard any post that doesn’t have that field (which theirs wouldn’t unless they also coded their probing application to scan for any custom fields in your comment form, which is highly unlikely). You could also set the value of this field to be some sort of unique identifier (like the PHP session ID) that the post page would check against also, but their app could not predict the value of. This would force their spam app to actually simulate a full browser session by loading your comment page first, then pulling out all the fields (including your custom ones), filling in their spam, and then submitting it. Of course, this is possible too, but again, it’s way too much trouble for them to go through just to get a few sites, when what they have now already works on everyone else’s. Also, their spam app would run a lot slower that way, since the way (I’m sure) that they do it now is just firing off a series of posts without ever having to wait for a reply, their workaround would have to connect, load the comments page, parse it, reformulate their post, and then submit - way too many steps.

Of course, none of this would stop someone from manually going through and posting spam comments as a real user, but I doubt and spammer would ever take the time to do this.