Blocking spam registrations in WordPress 2.1

WordPress 2.1 incorporates significant updates to the registration and login process, which means that the fix I outlined below no longer works. Here are revised instructions, if anybody is interested.

In wp-login.php at the root level:
Following:
$user_email = apply_filters( 'user_registration_email', $_POST['user_email'] );
add:
$user_verify = $_POST['user_verify'];

Following:
$errors['user_email'] = __('< strong > ERROR< /strong > : This email is already registered, please choose another one.');
add:
if ($user_verify == '') { // verification
$errors['user_verify'] = __('< strong > ERROR< /strong> : Only real users can register.');
$user_verify = ''; // obviously no effect as it stands at the moment, but deals with failed verification
}

Following:
< p >
< label > <?php _e('E-mail:') ... < /label >
< /p >
add:
< p >
< label > <?php _e('Are you real?') ?> < br />
< input type="text" name="user_verify" id="user_verify" class="input" value="" size="10" tabindex="25"> </label>
< /p>

I hope that makes some sense over the noise of Blogger formatting. As before, it adds a new input field to the registration screen which asks: "Are you real?" and which (as it stands) accepts any non-null response ("Yes", "y", "no", "What do you think?") to allow registration to continue.

I don't know whether the hooks exist to make this into a plugin, and I'm not promoting it on the wordpress.org site as if I were them, I'd take a dim view of somebody hacking around with their nice new code. However, this is effective. I got four more spam registrations in the 24 hours that I was running with 2.1 prior to modification, and they've stopped again now. And the domains from which they registered were new to me, so a blacklist wouldn't have helped.

Work on Wordpress registration

Sorry, this is technical. I've written a small modification for the Wordpress registration screen. This is because I am (already) fed up with what I assume are spambots registering accounts on a Wordpress blog/website that I have set up (here), in the hope that they can put comments full of adverts for Cialis, cheap mortgages and other less pleasant things on posts. The hope is forlorn, since all comments have to be moderated - but I wanted to find a way of blocking the registrations.

So here goes ...

I think the bots work by searching for the file "wp-register.php" in domains, and using the known default behaviour of this file to register accounts automatically. So make the default behaviour not work ....

In wp-register.php, find:
$user_email = $_POST['user_email'];
and add:
$user_verify = $_POST[user_verify'];
as the next line.

Find:
$errors['user_login'] = __('<strong>ERROR</strong>: This username is invalid. Please enter a valid username.');
$user_login = '';
}

and add:
if ($user_verify == '')
{
$errors['user_verify'] = __('<strong>ERROR</strong>: You can only register if you are real!');
$user_verify = '';
}

Find:
<label for="user_email"><?php _e('E-mail:') ?></label> <input type="text" name="user_email" id="user_email" size="25" maxlength="100" value="<?php echo wp_specialchars($user_email); ?>" />

and add:
<label for="user_verify"><?php _e('Are you real?') ?></label> <input type="text" name="user_verify" id="user_verify" size="10" maxlength="15" value="" />

Unless the person registering puts anything non-blank in the "verify" window, the registration won't work, I think - and a spambot would not know to look for this yet. However, by putting particular words in for verification - change the question on each website, or whatever - this fix could be made non-generic.

I'll let you know if it cuts down the spam.

UPDATE: A more usable (as it is a plugin), but less effective (as it is reactive rather than proactive), method of achieving the same thing can be found here.

ANOTHER UPDATE: Here's another plugin that works by blacklisting.

YAA: Due to the way special characters are formatted, you're probably better off reading the code for this on the WordPress.org Suggestions site. Here is a link to the relevant page - the code is about half way down.