[Plugin: SI CAPTCHA Anti-Spam] Comment SPAM getting past captcha

Exactly the same problem with me too, same kind of comments. There is always one or two sentences with one word seemingly purposely misspelt, and they all link to Bing, Google, Facebook or similar websites.

I haven’t had any spam comments for months since using si-captcha, then today I have 15 so far, all the same kind of comments. I have the difficulty settings set to high, but it hasn’t made any difference.

Spammers have been able to bypass my CAPTCHA, what can I do?

First check this: make sure the only other security plugins you have are Akismet or WP-spamFree. Akismet and WP-spamFree are the only other anti-spam plugins approved for use with SI CAPTCHA Anti-Spam, others can simply break the CAPTCHA validation so that the CAPTCHA is never checked. If another security plugin is combined(not Akismet or WP-spamFree), the captcha may not work. Be sure to always test the CAPTCHA after installing new plugins.

Sometimes your site becomes targeted by a spammer that uses a combination of a bot and human captcha solver. See this help forum for a solution

Thanks Mike. I was a bit worried, as it seemed to happen so quickly and with so many comments at once. I haven’t had a single spam comment since installing the plugin.

I don’t have any other security plugins installed, the only plugins I have are EXEC-PHP, TinyMCE Advanced, PageLists Plus and Fast Secure Contact form. Oddly, even though it appears to use the same captcha, I am not getting any spam via the contact form plugin.

I’ve just turned off comments for now. Hopefully they’ll go away.

Thanks a lot Mike for your strategy advice, really appreciate it.

Ronny

I have the same problem on my small personal blog with ~30 visits per day. No spam at all for months, now I’ve gotten almost 90 in two days, currently at one new every 4 minutes. The spam follows two different patterns, one with random text and a link, the other with a fake comment with one word misspelt (here‘s a image of a subset of them). I’m forced to switch to reCAPTCHA at the moment.

Hello,

I have the same problem as described here. Several spams, around 50 in a couple of days, with one misspelled word that seems intentional, links to Google etc. “name” sites with no apparent benefit to the spammer.

I have no other spam plugins installed.

A Google search, for one randomly selected comment with quotes and including the misspelling reveals several hundred exact same comments.

https://www.google.fi/search?ie=UTF-8&q=%22This+has+made+my+day.+I+wish+all+potsings+were+this+good.%22

So the problem seems to have spread quite far. I’ve had an occasional spam comment get through previously but now it seems someone has found a way to bypass the plugin entirely (or at least most of times, I have no idea of how many possible failed attempts the spammer has tried).

I’m more than happy to provide more info if it helps.

Just to make it clear, I’m very happy with the plugin and for the author taking the time to write in the first place. Just reporting the issue if it might help to solve it.

I’m having the same problem as other users of this plugin. I got virtually no spam at all for several months. Then, in the last couple of days, I started getting several spam comments per day. I use Mike’s Visitor Maps and Who’s Online plugin to track my visitors, and the spam always seems to involve pairs of visitors from different IP addresses visiting the site, one immediately after the other. I’m going to try the WP-reCAPTCHA plugin to see if that makes any difference.

Fred Chapman
[ Signature moderated. ]

Human spammers can target your site.
My last reply has my recommended solution.

Thanks, Mike! If I still get spam with WP-reCAPTCHA, I’ll try your solution. I’m just curious to see if WP-reCAPTCHA will make any difference. -Fred

While trying to solve another problem on another site, I came across the Stop Spammer Registrations Plugin. Here’s a partial description of what it does:

The Stop Spammer Registrations Plugin works by checking the IP address, email and user id of anyone who tries to register, login, or leave a comment. This effectively blocks spammers who try to register on blogs or leave spam. It checks a users credentials against up to three databases: Stop Forum Spam, Project Honeypot, and BotScout.

This might be another solution to comment spam!

I have been having the same problem with spam; however, I set my comments for admin approval & moderation before posting. This has stopped the attempts to post spam on comments page. The spammers did make further attempts at first, but seems like they have given up, at least for now. Either way, their links will not be posted on my website lol. They definitely have been able to by-pass recaptcha.

HOWEVER: on my sub-site i use the “puzzle” recaptcha, they have never broken into that as of yet. Fingers crossed!

On a page with submit form, I do not use recaptcha, and they broke into this form. I added an access code using a list box with only 1 valid ans. (all single digits) set to “not null.” So far no more spam postings, so we’ll see. The access code is an ans. to a question I posted. Prior, spammers have been able to bypass all spry validation for text boxes in DW, even the most restrictive lol. They are able to insert an entry into the db results table, and using -1 for required fields to gain entry.

God Bless!

Update: Since I switched to WP-reCAPTCHA, the spam comments have stopped. WP-reCAPTCHA is a little bit harder than SI CAPTCHA Anti-Spam, so perhaps the extra level of difficulty is enough of a deterrent. If the problem comes back, I’ll resort to more aggressive measures like the Stop Spammer Registrations Plugin.

Its now 9 months later than the last post on this topic and I can report that we are getting a LOT of spam. It penetrates the SI Captcha Anti-Spam plugin.

The only other plugin we are using is “AntiVirus” by Sergej Müller.
So far as I can tell this should not affect SI Captcha.

Sounds like we have to switch captcha plugin, i guess.

CommanderE, when I switched to the WP-reCAPTCHA plugin, I stopped getting comment spam, but only for a while. (By the way, WP-reCAPTCHA is no longer actively supported. The recommended replacement is Better WordPress reCAPTCHA, which works with Akismet.)

I noticed that most of the comment spam was coming from the same IP subnets in China and Russia. I blocked those IP subnets manually in the cPanel of my hosting account, and that killed the comment spam dead.

I also use the Stop Spammer Registrations Plugin on a client’s website, and it is extremely effective at preventing comment spam. It uses an automated approach based on the IP address and is free for commercial use. (Akismet charges for commercial use.) This plugin is more preemptive than Akismet, and it also works with Akismet.

Good luck in your war on spam!

Fred Chapman

P.S. If you are already using Akismet to combat comment spam, you might want to try the Conditional CAPTCHA for WordPress plugin. It works closely with Akismet and gives you the option of using either a simple CAPTCHA or a more challenging reCAPTCHA. The main benefit of this plugin is that it won’t hassle your blog readers with (re)CAPTCHA unless Akismet thinks their comment is spam.