Other WordPress anti-spam measures: rename wp-login.php, wp-comments-post.php, and wp-trackback.php

First published on November 1, 2006

You might have the best anti-spam plugin in the world, but that won’t stop spambots from visiting your site. If you have a WordPress blog, they will hammer your wp-comments-post.php and wp-trackback.php files automatically — you might not see the spam anymore, but the bloody spambots are still bogging down your server (10% of all hits to theblog.ca are spambots!).

One possible solution is to rename the files that accept comments and trackbacks! This way, the spambots encounter a “file not found” page when they are looking for your default wp-comments-post.php and wp-trackback.php locations. This is much easier on your server and if you do it correctly, your regular visitors won’t even notice as commenting and trackback capabilities will continue to work. However, make sure you change the references to these two files in your WordPress code. For most installations, here’s what you do:

1) In your base WordPress directory, rename wp-comments-post.php to something like wp-comments-roller.php, and rename wp-trackback.php to something like wp-trackback-hockey.php.

2) Edit your WordPress files that reference these two files. For most with WordPress 2.0, this means editing one reference of wp-comments-post.php each in your theme’s comments.php and comments-popup.php files (found in the folder wp-content/themes/yourtheme/); wp-trackback.php is referenced once in comment-functions.php (this is comment-template.php in 2.1.x) and twice in template-loader.php (found in the folder wp-includes/).

———————————————

If you allow registration on your site, rename wp-login.php (this type was suggested by Kent). This file is the registration file (as well as the login file) — if you rename it and give its location only to potential members (that is, don’t link to it with a big “Register here” link) not as many spambots will be able to figure out where it is. Just remember to change all references to the file in the WordPress files, including:

wp-login.php
wp-admin/admin-header.php
wp-includes/general-template.php
wp-includes/pluggable.php

———————————————

Note: if you’re unsure of what you’re doing, back up your files first! When upgrading, remember to do this process over again. Also, if you have Notepad++ or some other program that can search source code, use that to find any overlooked references of your renamed files.

This entry is filed under Blogs, WordPress and written by Peter Keung. You can follow any responses to this entry through the RSS 2.0 feed.

12 Responses to “Other WordPress anti-spam measures: rename wp-login.php, wp-comments-post.php, and wp-trackback.php”

November 11th, 2006 at 8:16 pm
fruityoaty says:

This is a great tip! I’ll try it out, after I backup my files. Thank you.
November 17th, 2006 at 5:24 am
Ajay D’Souza says:

For quickly finding all references to wp-comments-post and wp-trackback you can use Notepad++ and ask it to search in the WordPress directory.
February 28th, 2007 at 3:26 am
Charly Silaban says:

@Ajay D’Souza
Macromedia Dreamweaver can do it smoothly too.
Just hit Ctrl+F (Find) and choose your location option at “Find In” dropdown menu.

@Peter
Thx alot for this tips
March 9th, 2007 at 6:24 pm
Christian Donner says:

This is quite outdated, I must say. The bots that spam my blog actually parse the posting page for the correct name of the target. Minutes after I renamed the wp-comments-post.php, I got more spam:

200.88.223.xx – – [09/Mar/2007:22:49:37 +0000] “GET /t-mobile-sda-smartphone-faq.htm HTTP/1.1″ 200 12831 “…./t-mobile-sda-smartphone-faq.htm” “User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)”
200.88.223.xx – – [09/Mar/2007:22:49:41 +0000] “POST /wp-comments-allowed.php HTTP/1.1″ 302 5 “…../t-mobile-sda-smartphone-faq.htm” “User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)”
March 14th, 2007 at 3:04 pm
John Apache says:

Nice one, I changed my urls to wpcco.php and I am seeing intelligent spambots that issue a GET request for my blog page, then find the changed url by looking at the source! then they issue a POST full of spam to my renamed file! ahh.

http://www.askapache.com/2007/htaccess/fight-blog-spam-with-apache.html
May 15th, 2007 at 5:58 am
Magda says:

thank you for that tip! and also for the anti-spam plugin. I’m using both for my site.
September 17th, 2008 at 8:50 am
Jimmy says:

is it possible to trackback a site that doesn’t have the link on the page? If you guess it right will it go live?
September 17th, 2008 at 9:31 am
Peter says:

Hi Jimmy,

Yes, if you use the correct trackback link and that site has trackbacks enabled (my site doesn’t) it will work.
April 9th, 2009 at 2:09 pm
Torgeir says:

I was, well not actually spammed, but there where lots of visits on my site or wp-comments-post.php and I thought I should trick these spammers… So I made a copy of wp-comm… and wp-trackback…. and renamed the original files, then I altered the files these spammers would hit on, and wrote a simple refreshcode into them, sending the spammers to a site of my choice I just got lots of hits on a video I have on YouTube
November 22nd, 2009 at 12:02 pm
Alan says:

Hi Peter,

Suppose I do this. How does that then affect the automatic update from the control panel?

I ask because last night, I just upgraded from Version 2 to version 2.8 (a delay of 3 or more years), which had to be done manually.

My heart was in my mouth the whole time.

Regards,

Alan

Reply from Peter: You would have to rename the core files again. As for template changes, if you’re using a custom template you wouldn’t have to make any changes except as needed for any new features.
November 22nd, 2009 at 8:12 pm
Alan says:

Thanks for the reply, Peter.

At the risk of being tiresome, when you refer to renaming the "core files" again, I am assuming you mean renaming wp-login.php, wp-comments-post.php, and wp-trackback.php.

So if I understand, the update would just load new versions of the above, and I would need to rename them.

That’s it?

Regards,

Alan

Reply from Peter: Yes, that’s what I mean. Especially if you’re renaming wp-login.php, though, there are probably a few references you’ll need to change. As noted in the original post (which is getting quite old) you should also search through the WordPress files to see which files reference the ones you’re renaming.
November 27th, 2009 at 8:10 pm
Alan says:

Thanks Pete,

Sorry for the delay in acknowledging this, and thanks for your helpful site. It is quite obvious you devote a lot of energy and dedication to this project, and I appreciate it.

Regards,

Alan
http://www.alanstancliff.com/wordpress/