Wordpress Trackback Patch (1.22)

Posted in Code, Plugins by Elliott Back on April 5th, 2005.

Since I’ve been getting a half-dozen trackback spam or more per day, I decide to code up the following to prevent botnets from placing trackback onto my blog. Just insert into wp-trackback.php immediately before the line that reads require(’wp-blog-header.php’);. The code checks the trackback for any URLs, and makes sure that at least one of them matches the IP address of the sender: very simple. Blogs sending trackback are unimpaired, because they cite their own url which resolves to the IP address of their trackback sending software:

/* Find spam urls */
preg_match(”/^(http://)?([^/]+)/i”, $excerpt, $matches);
$urls = $matches;
$urls[] = $tb_url;

/* Make sure at least one URL resolves to spammer’s IP */
$spammer = true;
foreach($urls as $url){
$host = parse_url($url)["host"];
if(gethostbyname($host) == $REMOTE_ADDR) {
$spammer = false;
}
}

/* If spammer, die */
if($spammer) die();

I don’t know if this will help, but let’s hope it does! (Update, some hours later: No TB spam yet!)

This entry was posted on Tuesday, April 5th, 2005 at 4:34 pm and is tagged with code checks, botnets, header php, excerpt, urls, ip address, tb, spam, blog. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback.

Viewing 15 Comments

Priyadi 3 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

That code will block some legitimate trackbacks. Consider this scenario: a virtual web hosting server with several IP address, the first IP is 10.1.1.1 and http://example.com is placed in 10.1.1.2. When http://example.com does a trackback to your site, then the source IP address is not 10.1.1.2, but 10.1.1.1. Your code will then see this trackback as spam, CMIIW. You should check if the source IP address of the trackback is within C class block.

Furthermore, this will block all trackbacks from offsite trackback services such as haloscan.

reply edit reblog flag

http://priyadi.net

westi 3 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

Hmm, looking at that code its not doing entirely what you specify

The docs for checkdnsrr state that the return type is an int and:
Returns TRUE if any records are found; returns FALSE if no records were found or if an error occurred.

Therefore, looking at the code snippit above I think $spammer will get set to false is any of the urls resolve, rather than if any of urls resolve and match $REMOTE_ADDR.

reply edit reblog flag

http://ftwr.co.uk/blog/

Elliott Back 3 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

@Priyadi. Yes. I'm aware that virtual hosts and offsite trackbacks will break, but I don't really care, so long as the majority of non-spam trackbacks still function.

@Westi, that's a mistake. I should replace checkdnsrr() with gethostbyname() instead. I must have been tired... :(

reply edit reblog flag

http://elliottback.com/

Marco 3 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

What I do is scan incoming trackbacks like they are comments, with my Pivot-Blacklist software. It checks for MT-Blacklist patterns, personal blacklist patterns, SURBL listings and DSBL listings.

I have yet to receive the first spammy trackback ever since and the same goes for false positives. Haven't had any of those either.

reply edit reblog flag

http://www.i-marco.nl/weblog/

Priyadi 3 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

I'm willing to bet that most Wordpress users are on virtual hosting account and your code will block almost all of legitimate trackbacks :)

reply edit reblog flag

http://priyadi.net

David Russell 3 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

And by blocking the likes of Haloscan you are excluding Blogger and most of the other tools for people who can't afford a massive webhosting account. Plus most people who host small-to-medium sized blogs will be on shared hosts, and if they can't trackback then they won't link to you either.

reply edit reblog flag

http://www.davidarussell.co.uk/

Elliott Back 3 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

It's a tradeoff, for sure, and that's why it's called a "hack." And, since I use WP, most people that want to trackback me also use WP, and we all get along. I rarely (ever?) get a trackback from haloscan. So, yeah. Don't use if you don't want to block a lot of good trackbacks with the bad. In fact, it's not actually going to necessarily block the bad ones either! It just "happens" to ;)

reply edit reblog flag

http://books.elliottback.com

David Russell 3 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

But it also screws people who 'also use WP' but on a 'shared server' host- like me for example.

reply edit reblog flag

http://www.davidarussell.co.uk/

N4P4LM 3 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

please hack this IP

212.219.231.1

anyone who see's this and is a hacker, please have a go, its a school website in Uk, Wales, South Glamorgan, Cardiff. Called Fitzalan High

http://www.fitzalan.cardiff.sch.uk/

even on theyr own website theyr asking (begging) students for help creating the school website... LAME!

its a pathetic school... someone wana have some fun with theyr systems?

lmfao

i'd love to see it pwnd by many hackers

yours sincerily N4PALM

reply edit reblog flag

Mobile Dev 2 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

Use it with care!
This "hack" cuts off up to 90 percent normal Trackbacks from friendly blocks!
A lot of sites have a same IP address because of share hosting or same proxy

reply edit reblog flag

http://cellphonesclub.com/wp/

Quix0r 2 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

Hello Elliot,

I use a different "IP filter" on my webpage. It filters the accessing remote address and the requested hostname (rember: $_SERVER['SERVER_NAME']), It also does a "syntax check" on the given server name. So it does also - hopefully - prevent some attacks on the SERVER_NAME element.

Additionally it tries to resolv the given hostname and when this is different to $_SERVER['SERVER_ADDR'] then it blocks the access attempt. :) It will also block if the server's name is not resolvable or the remote address.

If you like I can send a copy of it to you.

Quix0r

reply edit reblog flag

http://blog.mxchange.org

99tvb@99tvb.com 2 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

free,film,http://www.99tvb.com

reply edit reblog flag

http://99tvb99tvb.com

Quix0r 2 years ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

That guy with the free film is a spammer. :( Maybe you want to install the Spam Karma 2 Plugin plus my CPR plugin. :)

reply edit reblog flag

Kirill 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

I think that it,s impossible catch spammer by IP filter...

reply edit reblog flag

http://save-time.org

seo service consultation 1 month ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

are you guys really complaining

Beginning of a very valid idea, good job.

reply edit reblog flag

http://seoserviceconsultation.com

Trackbacks

(Trackback URL)

Sulnierd Dieetf
7/20/2005 at 4:21 am

martinho da vila Wordpress Trackback Pa...
Ufe Nasselstein
7/20/2005 at 4:24 am

knapster Wordpress Trackback Pa...
Kerstin Soedler
8/23/2005 at 6:09 pm

ESOMEPRAZOLE Wordpress Trackback Pa...
Nerdcore - Blog far nerdiges Allerlei » Trackbackspamalarm!
9/9/2005 at 6:26 am

[...] Mal wieder, 15 mal Bankcreditloansfuckshit in 2 Minuten, *****. Und das trotz Hashcash. Aber det macht ja nur die ...
a crank’s progress » killing trackback spam
6/5/2006 at 1:59 am

[...] Wordpress Trackback Patch (1.22) by Elliott Back: Since I’ve been getting a half-dozen trackback spam or more per day, ...
狗爺語錄 » Crusade against trackback spam
1/9/2007 at 9:51 am

[...] This patch by Elliott Back checks if IP address of some URL is equal to the trackback sender; I ...

Elliott C. Back: Technology FTW!

Wordpress Trackback Patch (1.22)

Add New Comment

Viewing 15 Comments

Add New Comment

Trackbacks

The Search

Related Posts:

Wordpress SEO Trick

Today’s Wordpress Question #1

No-Sex Patch

Warcraft 1.20d Patch Problems?

Pinging Technorati Makes Spam

You Came From

The Meta