I run PixelGravitas , a small team that looks after WordPress sites, and one of the sites we look after received 285,000 spam comments, roughly one a minute, most of them published automatically. It was running the security plugin I build. The plugin logged none of it, because nothing in it watched comments at all. Firewall, login protection, malware scanner: all green, while the front of the site filled with spam.

So I built comment and bot protection into the plugin. Here's what one day looks like now, from the plugin's own daily summary email:

5,385 spam comments refused

29 hits on the old login address turned away (the login page was moved, so bots still trying the default address get nothing)

3 malicious requests blocked

1 username-enumeration attempt blocked

Real comments still come through: 16 since it was switched on. And that summary is one email, not 5,385 moderation notices.

This post is about how it decides, what surprised me, and where I'd like your opinion.

The constraints

No CAPTCHA.…