14

I have a wordpress blog under my own domain. It does not have special security.

For the past 1 week, my blog got spammed by someone from Russia - I think the contents of my blog somehow angered him. He posts about 20 spam comments (only links to drugs, etc..) daily at staggered hours. I just can't understand. Comments need to enter name, email and also to pass a "captcha" graphics verification. It would be extremely boring and tedious to do such spamming manually. In general comments cannot be done through automated software unless some expert hack into my site.

Does anyone know if it is likely someone is able to hack into my site?

Improve this question
3
  • Welcome! Your question needs more detail. A great place to start is to review the web server logs for you application. Also review the version of all components and modules. You want to know if something has an update available or vulnerability. Then update your question with what you've found.
    – user2320464
    Commented Jul 20, 2017 at 17:02
  • Do you need to fill a Captcha for every comment on your blog? I don't often leave comments on blogs, but when I do, I am usually not asked for a Captcha after creating an account.
    – Shokhet
    Commented Jul 21, 2017 at 13:41
  • 1
    Captchas are never a defense against a pissed off human who wants to target YOU. They are only a defense against bots who assault 100,000 blogs just like yours: as the adage says, "I don't have to outrun the bear, I just have to outrun you." If he wants to be in 20,000 blogs, he won't invest any more energy cracking Captchas than he must to get into 20,000. For you, it means be better than the worst 20,000.
    – Harper - Reinstate Monica
    Commented Jul 21, 2017 at 22:03

4 Answers 4

Reset to default
37

Posting spam doesn't require hacking in any ways.

Regarding the captcha, there is two possibilities:

  • Either the captcha is automatable (I don't know for your website, but I still encounter a lot of websites bearing completely useless captchas).
  • If the captcha is not automatable, then spammers can hire people to solve them for as low as $2 for a thousand captchas.

Your website is usually not specially targeted: they just target any random URL where comments are directly published. When possible, prefer to avoid automatically publishing visitors comments but publish them after moderation, at least ensure that the rel="nofollow" property is used for links in comments so spammers websites doesn't gain any reputation by posting links in your comments section.

Improve this answer
14
  • 1
    Are there any non automatable captchas left?
    – CodesInChaos
    Commented Jul 21, 2017 at 10:40
  • 1
    @CodesInChaos you mean a kind of captcha that neither computers nor humans can easily solve? There are some, but they are not very practical ;) ... (better adopt a layered protection where the captcha is only one piece of the system)
    – WhiteWinterWolf
    Commented Jul 21, 2017 at 10:52
  • 14
    @CodesInChaos Regarding Google Re-captcha image classification, I strongly think there may be other unrelated interests at play. While Google was building their Google Map service, they asked people to fill street numbers as a captcha service, now they ask to associate some semantic to random pictures or recognize special building like stores or recognize a road sign (Google-car anyone?). I think that this is not by accident that these images can be analyzed by computers, I suspect that captcha users are actually used as data source for machine-learning to improve such algorithms.
    – WhiteWinterWolf
    Commented Jul 21, 2017 at 11:17
  • 29
    @WhiteWinterWolf That's not some weird conspiracy theory, that's the explicit point of reCAPTCHA: From Google's page on it: Every time our CAPTCHAs are solved, that human effort helps digitize text, annotate images, and build machine learning datasets. This in turn helps preserve books, improve maps, and solve hard AI problems.
    – user76364
    Commented Jul 21, 2017 at 13:16
  • 1
    Just don't use Sony's very broken CAPTCHA.
    – jpmc26
    Commented Jul 22, 2017 at 4:00
17

It's unlikely he's hacked into your site. It's also unlikely he's doing this manually. If you run a Wordpress site, bots will eventually find it and spam the hell out of it. Captcha resolution can always be outsourced to someone in the third world for pennies, who literally does nothing but answer captchas all day.

Since this is a personal blog, you ought to install the Akismet plugin. It crowd-sources the detection of spam (so if he spammed some other site first, by the time he gets to yours he's already a known spammer and gets blocked accordingly).

Improve this answer
4
  • I think it is as you all said. I do notice from my awstats that it is from a particular IP address from "Russian Federation" - it should not have any genuine interest in the contents of my blog. I understand my site contents do irritate some people badly. Comments to my blog is not automatic; usual comments would await my moderation. Luckily, wordpress has a blacklist function so that the spammers comments all go to trash - which could be deleted in bulk - "empty trash". Without a blacklist, it would indeed be a headache. Many thanks.
    – itsme
    Commented Jul 20, 2017 at 15:53
  • You can also set up Wordpress to not allow commenting on posts older than some specified number of days. That's certainly not perfect (it does cause some collateral damage), but it does cut down a lot on spam comments on old posts.
    – user
    Commented Jul 20, 2017 at 16:59
  • @itsme if you notice it's from a "certain IP address"... blacklist that IP address? blacklist Russia?
    – WernerCD
    Commented Jul 21, 2017 at 5:27
  • @itsme if this answer answered your question then then you should "accept" it :)
    – user2121
    Commented Jul 22, 2017 at 10:57
1

"It does not have special security"

As you say, you do have captcha verification. Yes, it's "normal" security, not special. Do consider adding anti-spam. Akismet does a pretty decent job.

"I think the contents of my blog somehow angered him".

Most spammers (and hackers) don't care much about your content. They just want clicks to their sites. It's a constant arms race between spammers and victims - so be prepared to keep upgrading your spam defenses (and other security steps too) as you go forth. :)

Back to:

It does not have special security

While regular spamming doesn't require them to hack your site, it is possible to exploit simple vulnerabilities to bypass forms controls and post not only comment-spam but spam posts and worse, inject malicious javascript/links into your site. You wouldn't even notice this under normal circumstances. Therefore I would strongly recommend that you take steps for additional security.

As a long term security pro, I've seen even "I regularly update and patch" users get nasty surprises when Google marks them as malicious sites because hackers regularly get small windows of opportunities to even get past those normal precautions.

Most good security requires you "Go Pro", but some basic stuff can be free. e.g., I have been using BBQ Block Bad Queries. The free version is pretty good and lightweight. We liked it so much that we built similar functions into our own wordpress security plugin + mobile app - ActiFend (alert: shameless plug :| ).

Unfortunately, WordPress security advice has largely been the same for years; ignoring recent trends in hacking. I did write something applicable to recent times - Does your WordPress Security Plugin really protect?

Improve this answer
0

I use https://en-gb.wordpress.org/plugins/wp-spamshield/ - used to get loads of spam but this somehow cuts it all out, no captcha needed but genuine comments get through ok - I'm not related to this plug-in in anyway, other than I've used it for a few years, it's free and works well.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .