AccessNow Spam Eater is a free WordPress plugin that stops contact form spam without a CAPTCHA: no puzzles for your visitors, no account, and nothing sent to an outside service. Version 3.0 is a security update. Bots that read your page first can no longer copy Spam Eater’s checks into the forms they send, because each visitor now gets their own token from your site.
Update to 3.0 from Plugins in your WordPress dashboard, or get it from AccessNow Spam Eater on WordPress.org (Plugins → Add New, search “AccessNow Spam Eater”).
What happened
In late October a bot found the newsletter and free-guide forms on a site we look after. It signed up dozens of real people’s email addresses, all with the first name “Test”, about one a minute. Every one of those people got an email they never asked for. This is called sign-up bombing: the bot uses your form to flood someone else’s inbox.
Spam Eater let them through. Its checks were working, but one of them had a weakness. To prove a person touched the page, the form carried a hidden value that was added after a mouse move, a key press, a touch or a scroll. That value was the same for every visitor and was in the page itself. A bot that read the page once could copy it into every form it sent, and pass.
What 3.0 changes
- Each visitor gets their own token. When someone first moves the mouse, presses a key, touches the screen or scrolls, their browser asks your own site for a token that belongs to them and to that form. It is never in the page, so there is nothing to copy.
- A token can’t be reused forever. Each one passes 10 submissions, enough for someone to go back, fix a mistake and send again, or to work through a form with several steps. A bot that gets one token and sends many forms with it is refused with the new reference code SE-R4.
- One address can only get so many. 60 tokens an hour, counted with a one-way hash of the address that is gone within the hour.
- Quick visitors aren’t caught out. If the first thing someone does is click Send (say, straight after the browser filled in the form), the form waits a moment for their token, then sends as usual.
Your visitors see no difference. Page caching keeps working: the token is fetched from your site, not stored in the cached page. Pages already open when you update keep working for a day.
Is there anything to do?
Just update. One thing to check: if a security plugin stops visitors reaching admin-ajax.php, real visitors will be refused with SE-F4, because their browser can’t fetch the token. Allow it, and they will get through. What each reference code means lists every code and what to do about it.
Sign-up forms need one more thing
No check that runs in the page can stop a bot that drives a real browser the way a person does. For a newsletter, a free download or any form that sends an email to the address someone types in, also ask people to confirm their address by clicking a link before anything else is sent (double opt-in). Then a bot can only ever cause one email, and nobody is added to your list who didn’t ask to be. That is what fixed the site above.
Get it
AccessNow Spam Eater is free, with no cookies, no tracking and no calls to outside services. Get it from WordPress.org or the AccessNow Spam Eater page, where you can see how it compares with other anti-spam plugins. How Spam Eater tells people from bots explains every check. Building your own forms in PHP, outside WordPress? Spam Eater for PHP forms 0.2.0 has the same change.
