Justin Parr

<h3>Update: 6/2015</h3>
<p>Changed e-mail token and math problem confirmation logic.  Previously, everything happened all at once, and the user would get prompted mutliple times for the math problem.<br />
Now, the user must answer the math problem first, before the e-mail token is sent.  Once the math problem is correctly answered within the session, it isn’t asked again.  The user must now enter the correct token, which results in successful registration.<br />
SPECIAL THANKS TO OLEG M. FOR HELPING ME IDENTIFY, FIX, AND TEST THE ERROR!!</p>
<h3>Update: 5/2015</h3>
<p>Added E-mail confirmation token.  Prevents registration until user enters a token sent via e-mail.</p>
<h3>Features:</h3>
<ul>
<li>Prevent users from registering, if their IP or e-mail address is listed in the “Comments” blacklist (Settings..Discussion)</li>
<li>E-mails user a 4-digit token, and requires the user to enter the token in order to register.</li>
<li>Users must solve a simple math problem (Add two one-digit numbers).</li>
<li>Places user IP address in “Website” field.</li>
</ul>
<p>This is a super-simple user registration spam countermeasure.  I searched for a plugin that was SIMPLE and EFFECTIVE.  I looked at quite a few plugins that promised the desired effect, but were either cumbersome, or included too many unneeded or unwanted features.  Likewise, there are some very simple plugins that are less-than-effective.</p>
<h3>This plugin is VERY simple:</h3>
<p>If the user’s IP or e-mail address is listed in the “Discussion” comments blacklist, it prevents the user from registering.  This functionality should really be built in to WordPress, so, you’re welcome.</p>
<p>When the user registers, they are presented with a simple math problem – adding a 3-digit number to a 1-digit number.  99% of the “user reg spam” is based on bots being able to attack the basic WordPress registration form.  By adding even a simple math problem, most bots will fail, removing your site as a target of opportunity.  Criminals go after what’s easy – if you make it slightly more difficult for them, they will go after someone else.</p>
<p>Once the user solves the math problem, they are sent a 4 digit token via e-mail, and must enter that token to continue registration.</p>
<p>Finally, knowing the location from where your users register allows you to more effectively evaluate and block the source.  This plugin adds the user’s IP address (at the time of registration)  to the “Website” field.</p>
<p>Go to http://whois.arin.net to find out who they are.  If you decide to block the IP,  add the IP address, part of the IP address, or e-mail domain to the “Discussion” comments blacklist, and ANY user registrations from an IP address matching that pattern will be blocked.</p>
<h3>Configuration</h3>
<h3>To Configure the Plugin:</h3>
<p>NOTE:  NO CONFIGURATION IS REQUIRED.  This plugin is fully-functional using the default values.</p>
<p>In the Plugins page, click “Settings” underneath the “JP User Registration Blacklist” plugin.</p>
<ul>
<li>
<p>Seed:  This value determines how the answer to the math problem is masked.  Periodically change this, to keep the spammers and criminals at bay.  The initial value is randomly-generated.</p>
</li>
<li>
<p>Failed Math Response:  Error message displayed to the user, if they fail to correctly solve the math problem.</p>
</li>
<li>
<p>Rejected IP or E-mail:  Error message displayed to the user, if their IP or e-mail is blocked.  Keep this simple and generic, to keep them from knowing why they are being blocked.</p>
</li>
<li>
<p>Form field name for math problem:  This field name contains the user’s answer to the math problem.  Periodically change this, to keep the bots away.  The initial value is randomly-generated.</p>
</li>
</ul>
<h3>To Block an IP address</h3>
<ol>
<li>In the WordPress Dashboard, go to “Settings…Discuss”</li>
<li>To block all or part of an IP address, add it on its own line to “Comments Blacklist”</li>
<li>To block all or part of an e-mail address, add it on its own line to “Comments Blacklist”</li>
<li>Click “Save”<br />
(For more details, see Examples)</li>
</ol>


JP User Registration Blacklist

Prevent User Registration Spam, and Track New User IP address

apasionados

<p>Updates the “Comment Blacklist” in Settings / Discussion with a list terms from a remote or local source. By default it get’s the data from Github <strong>(“<a href="https://github.com/splorp/wordpress-comment-blacklist/" rel="nofollow ugc">wordpress-comment-blacklist</a>“)</strong> by <a href="https://github.com/splorp" rel="nofollow ugc">Grant Hutchinson</a>) but you can also get them <strong>from any URL</strong> or from a <strong>local blacklist.txt file</strong>.</p>
<p>This plugin is an enhanced version of the plugin <a href="https://wordpress.org/plugins/comment-blacklist-manager/" rel="ugc">Comment Blacklist Manager</a>. We decided to create this enhanced version of the plugin, because we wanted to be able to add blacklists without using filters and directly from the WordPress administration. You can still use a filter to modify the blacklist sources if that is more convienient for you. And we also wanted to have more information about the plugin in SETTINGS / DISCUSSION; for example when the blacklist was updated and when it will be updated next time, when the blacklist sources were updated, etc.</p>
<p>You can configure three sources for your blacklists:</p>
<ol>
<li><strong>Default blacklist</strong> (which can be disabled): <a href="https://github.com/splorp/wordpress-comment-blacklist/" rel="nofollow ugc">wordpress-comment-blacklist</a> by <a href="https://github.com/splorp" rel="nofollow ugc">Grant Hutchinson</a>). Please keep in mind that if there is no other blacklist source defined, this will be used as default, even if it\’s not selected.</li>
<li><strong>Blacklist from remote URL</strong>: You paste the URL to the blacklist and if the file exists and can be accesed (must return code 200) it will be used as a blacklist source.</li>
<li>If you want to include a <strong>local blacklist</strong> for the site, you can upload a blacklist.txt file to the UPLOADS folder and it will also be taken into account. The blacklist.txt file has to be in the root of the UPLOADS folder; it will not be recognized if it\’s for example in /uploads/2025/12/ and the file has to be accesible via http/https (if the access to the file is protected it can\’t be used).</li>
</ol>
<p>And you can use the filter <code>cblm_sources</code> to replace all the blacklists or to add more. If you replace all blacklists with the filter, the settings done in the WordPress administration will be ignored. We decided to keep the same filter as used by “Comment Blacklist Manager” to make it easy to switch between both plugins.</p>
<blockquote>
<p>Please note: <strong>After the September 2023 update only users with administrator privileges can use this plugin.</strong> If you’re not an admin you will get following error: “You do not have sufficient permissions to access this page”.</p>
</blockquote>
<h4>What can I do with this plugin?</h4>
<p>The plugin updates the “Comment Blacklist” in Settings / Discussion with a list terms from a remote or local source. By default it get’s the data from Github (“<a href="https://github.com/splorp/wordpress-comment-blacklist/" rel="nofollow ugc">wordpress-comment-blacklist</a> by <a href="https://github.com/splorp" rel="nofollow ugc">Grant Hutchinson</a>) but you can also get them from any URL or from a local blacklist.txt file.</p>
<h4>Why do I want to update the “Comment Blacklist” in Settings / Discussion?</h4>
<p>If you want to reduce spam received in your comment forms but also in your contact forms (for example when using Contact Form 7), using blacklisted terms can help.</p>
<p>Contact Form 7 encourages to use: Akismet, reCaptcha and the comment blacklist to reduce contact form spam.</p>
<blockquote>
<p><em>Contact Form 7 supports spam-filtering with Akismet. Intelligent reCAPTCHA blocks annoying spambots. Plus, using comment blacklist, you can block messages containing specified keywords or those sent from specified IP addresses.</em></p>
</blockquote>
<p>The best way to reduce the contact form 7 spam is to use a very extensive term database which is updated regulary with new spam terms. And this plugin does exactly this: Updating the blacklist regularly.</p>
<h4>Why are you using the “Comment Blacklist for WordPress” from Grant Hutchinson as default source for the blacklist?</h4>
<p>Since 2011 Grant Hutchinson has been identifying and compiling over 34,000 phrases, patterns, and keywords commonly used by spammers and comment bots in usernames, email addresses, link text, and URIs.</p>
<p>His blacklist is very extensive and that’s why we love it.</p>
<p>As with all compilations, this blacklist is a work in progress and it is updated more or less every month. And each of these updates will be included automatically with the update process that runs every 24 hours.</p>
<p><em>Sometimes simple is better.</em></p>
<p><strong>If you know another source that is as extensive as this one, drop us a message and we will check if it’s interesting to add it also as a default.</strong></p>
<h4>System requirements</h4>
<p>PHP version 5.6 or greater.</p>
<h4>Comment Blacklist Updater Plugin in your Language!</h4>
<p>This first release is avaliable in English and Spanish. In the “languages” folder we have included the necessary files to translate this plugin.</p>
<p>If you would like the plugin in your language and you’re good at translating, please drop us a line at <a href="https://apasionados.es/contacto/index.php?desde=wordpress-org-apa-comment-blacklist-updater-home" rel="nofollow ugc">Contact us</a>.</p>
<h4>Further Reading</h4>
<p>You can access the description of the plugin in Spanish at: <a href="https://apasionados.es/blog/" rel="nofollow ugc">Actualizador lista negra de comentarios | WordPress Plugin</a>.</p>
<h3>Contact</h3>
<p>For further information please send us an <a href="https://apasionados.es/contacto/index.php?desde=wordpress-org-apa-comment-blacklist-updater" rel="nofollow ugc">email</a>.</p>


Comment Blacklist Updater

Update "Comment Blacklist" spam terms to manage spam in forms and comments

JP User Registration Blacklist vs Comment Blacklist Updater