WP-Gatekeeper
In my post on rel="nofollow", I mentioned the use of easily human-comprehensible challenge questions like “What is Eric’s first name?” as a way to defeat spambots. There were two points made in the comments that I had considered but hadn’t brought up, given that they were tangential to the point of the post. They were:
- Spammers could set up a database of questions and answers used on sites. They might or might not share it with each other, but the point is that if I set up “What is Eric’s first name?” as the sole challenge, the human running the spambot could build the ability to answer the question into the spambot, thus defeating it. Quite true.
- In order to make it more difficult to do this, there could be a set of challenges from which one is picked randomly. So I might have three challenges asking for the first names of myself, Kat, and Carolyn. Every time a comment form is delivered to a browser, one of the three challenges, picked at random, is included. This would make it more difficult for a human spammer, since he (or she) would have to find all of the challenge questions. work out the responses, and build them all into a database, keyed to each site’s domain.
So over the weekend, I built as a proof of concept (and also as an exercise in learning more about how PHP, mySQL, and WordPress work) a WordPress package to do what described in the second point above. It’s called WP-Gatekeeper, available from my WordPress Tools page, and if you’re brave you can give it a try. Why brave? Because the installation involves hacking a few WP files and adding a new entry to the admin menu, not to mention firing up a plugin. And if you do it in the wrong order, you can break commenting for a short period. There are DIY installation instructions on the WP-Gatekeeper page, for those who still want to proceed. You also need to be brave because if you install it, you’re running code written—well, actually, adapted—by someone with only beginner-to-intermediate PHP skills. I’ve been testing it locally and everything seems fine, but this is even more “use at your own risk” software than usual. Got it? Good.
Accordingly, WP-Gatekeeper is currently considered beta software. I’m making it available now in the hopes that people more experienced than I with PHP and WordPress can take a look, hack on the code, and make it more efficient and the whole package easier to install. I’m already aware that in WP 1.5, adding the admin page is much easier and doesn’t require hacking files, but I wrote WP-Gatekeeper in 1.2 and want it to work there, since that’s the latest public version. Thus, any optimizations should work in 1.2. When 1.5 (or whatever the next version number is) comes out, then I’ll worry about it.
Of course, there’s still nothing that prevents a spammer from registering questions and answers into a database, but the admin page makes it easy for a blogger to add, remove, modify, and re-key the challenges. That will make tracking them more difficult, so long as a blogger puts effort into maintaining the list of challenges. It gets back, in the end, to maintaining your blog. The more maintenance you put into something, the better its shape will stay.
I’m also interested in suggestions for how the overall system could be made harder to bypass with a bot, and easier for a WP admin to run. One feature I plan to add before going final is the ability to have the keys replaced on a regular basis, with the interval (daily/weekly/monthly/etc.) set by the admin. The other driving consideration here is that the system should be fully capable of working even if JavaScript is disabled. It’s an accessibility thing; just go with me on this. (Accessibility is the main reason I did this rather than install an image CAPTCHA solution, as it happens.)
Got feedback? Let’s hear it.
