Select Page

Slowing down spamming! Hashcash challenge in com_akocomment

So I have just finished and test the integration of a hashcash challenge (MD5) into the com_akocomment component…using the code of this page only an extract but all credit to original authors:

  • C.S. –
  • Gene Shepherd –
  • John F
  • Magenson –
  • Matt Mullenweg –
  • Matt Warden –
  • Paul Andrew Johnston –
    and to  Arthur Konze, the author of com_akocomment : [email protected]

I must also pack everything into a new version of the component or better say refactored the code a little bit, because it is still full of debug statements…

robot wo want to submit spam comments must pay the prize (using cpu time, approx. 100 hashcash max. each minute on a high end computer) and compute manually (can not be automated by submitting directly to the form) a Hashcash (

Extract form the document of wp-hashcash:
"Wordpress Hashcash
Taking Matt’s stopgap spam solution, which sends precomputed hashes to be echoed back by the user-agent’s form, I’ve added dynamic generation of the md5 hash. Rather than write it to a hidden field, we wait until the form is submitted to compute the hash. This prevents spammers from automatically scraping the form, because anyone wanting to submit a comment *must* execute the javascript md5.
This plugin used to be called “Spam Stopgap Extreme.â€? Now it’s been moved to the WP plugins repository under the new name “Wordpress Hashcash.â€? All future development will take place through the plugins repository.
New Features:

  • Log and emailing of spam, for your records
  • Client-side hash required.
  • The “Keyâ€? is hashed once before output to the html form–so spammers can’t make sense of it, and then hashed on the client side, again.
  • The “Keyâ€? is now a time-dependent, visitor dependent hash, for more variability. You can’t just compute the right md5 once, because it’s always changing.
  • Failure to compute the md5 hash results in a 1 minute timeout penalty. "

Expect a release before week end…But I must also inform Arthur Konze first for a feedback
Then I will add the same code in login page (because generizing the code),in order  to avoid brute forcing password in admin login page….and in guestbook (because I was spammed many times last week)

About The Author

Cédric Walter

I worked with various Insurances companies across Switzerland on online applications handling billion premium volumes. I love to continuously spark my creativity in many different and challenging open-source projects fueled by my great passion for innovation and blockchain technology.In my technical role as a senior software engineer and Blockchain consultant, I help to define and implement innovative solutions in the scope of both blockchain and traditional products, solutions, and services. I can support the full spectrum of software development activities, starting from analyzing ideas and business cases and up to the production deployment of the solutions.I'm the Founder and CEO of Disruptr GmbH.