Trackback Validator Plugin
Introduction
The TrackBack Validator plugin for WordPress performs a simple but very effective test on all TrackBacks in order to stop spam.
Legitimate TrackBacks are sent by people commenting on your weblog, accompanied by a URL that points to that commentary. Spam TrackBacks are accompanied by a URL that points to a pay-per-click affiliate website or other irrelevant material. The Validator exploits this key difference:
- When a TrackBack is received, the plugin retrieves the Web page located at the URL included in the TrackBack.
- If the page contains a link to your weblog, the TrackBack is approved.
- If the page does not link to your weblog, the TrackBack is flagged as spam and rejected.
Because TrackBack spammers do not set up custom Web pages linking to the weblogs they attack, this simple test will quickly reveal illegitimate Trackbacks.
We are actively developing additional heuristics to add to the plugin; if you observe TrackBack spam that makes it past this plugin, please let us know.
—Dan Sandler and Andy Thomas
Downloads
- TrackBack Validator Plugin v0.7.1 (ZIP)
- Older versions: v0.7, v0.6
Installation
Prerequisites: You need an installation of WordPress version 1.5 or later.
- Unzip the trackback_validator_VERSION.zip file; it will contain the file README.txt and the directory TBValidator. Move TBValidator to your <wordpress-directory>/wp-content/plugins directory.
- Using the WordPress administration interface, turn on the Validator from the “Plugins” page.
- The “Options” page will now have an additional tab, “Trackback Validator,” which allows you to configure the plugin and to see a graph of recent trackback classifications (see the screenshot).
Changelog
- version 0.7.1 [21-May-2006]
- Fixes a bug with WordPress 2.x blogs.
- version 0.7 [17-May-2006]
- Removed problematic dynamic link page detection. (Additional research will tell us what exactly we need to look for in order to defend against dynamically generated spam sites; since we’ve never seen any of these in the wild, it’s not currently a high priority anyway.)
- Improved the robustness of data reporting. Reports now use an HTTP POST interface and will submit data to trackback-db.cs.rice.edu, rather than a fragile IP address (!). Data reported by our users is crucial to the research process; see our forthcoming technical report to see how this data is used.
- Fixed the trackback history graph. It would silently fail on hosts without GD installed; the new version doesn’t require GD at all (and is therefore a lot simpler).
- version 0.6 [announced 19-Nov-2005]
- Added a simple check against spammers’ dynamic link pages.
- Simplified the data submission routines.
- Set up framework for PageRank comparisons.
- Cleaned up code.
- version 0.5 [announced 24-Aug-2005]
- first iteration
A plea for help
This is the subject of active research by the Computer Security Lab at Rice University. We ask you to enable the “Submit Data” option, to send data back to us for scholarly analysis. You’re free to use this plugin without reporting data, but your data is important to us as we attempt to understand the evolving attack profiles of weblog spammers.
Screenshot
Support
For the time being, just get in touch with us if you run into bugs (or false negatives/positives).
Hi, I was interested in your plugin, but it doesn’t seem to be as strong as I would need. I’ve got moderation on for all comments and trackbacks, and am running Akismet, Referrer Bouncer, Bad Behaviour, and reCaptcha. Even with all of these, I’ve got spam showing up on Akismet (not on my blog, fortunately) that I clean out periodically. Since the spam is getting past reCaptcha, I think that it’s trackback spam instead of comment spam.
I’ve now installed WP-Ban, and entering some IP addresses for repeat offenders. If I’m understanding how the Trackback Validator Plugin works, it would only put flag the trackback to be put into the Akismet queue, and I would be in the same place as I already am, i.e. cleaning up by using WP-Ban to block specific IP addresses.
I know that cleaning up the Akismet queue isn’t as bad as having actually spam showing up on the blog … but I finally installed WP-Ban because I figured out that across three blogs, I maybe spend 5 to 10 minutes per day clearing off spam. I supposed that I could just leave it alone and let the entries expire naturally, but I have caught a few false positives over time, so I’m not inclined to do that.
Web Hosting Reviews, Web Site Hosting
I couldn’t understand some parts of this article, but it sounds interesting
Hi. I’ve been running Akismet, Angsuman’s Referrer Bouncer, Bad Behavior, reCAPTCHA, Worst Offenders and WP Ban on two of my blogs. Spam isn’t visible on the blogs, because I moderate everything, but there’s always a long list of entries in Akismet to clean up.
Since I installed reCAPTCHA, I assumed that the spam comments were coming from trackback spam. However, after running Trackback Validator for a week, the Recent Activity is zero. Does this mean (a) that I’m not getting trackback spam, or (b) I don’t need the Trackback Validator Plugin after all?
How do I diagnose where the comment spam is coming from? Looking at the access logs, I see “POST /blogs/wp-comments-post.php” with status codes of 403 (probably from WP Ban), 302, and 417. Thanks.
[...] testing Trackback Validator Plugin by linking to this post on the sydney siggraph website [...]
[...] Rice University Trackback Plugin: This plugin, designed by Rice University students, is the original trackback validator that the above listing is based on. [...]
“Because TrackBack spammers do not set up custom Web pages linking to the weblogs they attack, this simple test will quickly reveal illegitimate Trackbacks.”
Unfortunately, this is no longer true. They’re doing exactly that. Is there any way to fix this beyond simply adding all trackbacks into an auto-moderation queue?
[...] En base a un archivo modificado de wp-trackback.php que me envió Maty, hice unos cambios a éste para que haga casi lo mismo que el plugin Trackback Validator, que básicamente verifica que el sitio que envÃa la petición contenga un enlace recÃproco a la entrada a la que se hace referencia (ver el paper para mayores detalles). La limitación de este método, tal y como reconoce una de las personas que participó en ese proyecto, es que puede evadirse fácilmente de diferentes modos (con CSS, comentarios HTML, JavaScript, generación dinámica de contenidos, etc). [...]
[...] Trackback Validator: Bu eklenti Rice Üniversitesinin bir araÅŸtırma planı. Ne kadar iyi çalıştığını bilmiyorum ama kurduÄŸumdan beri çok az trackback spam almaya baÅŸladım. [...]
More WordPress Plugins and Where to Find Them
WordPress is the most popular blogging software for domain based blogs. While Blogger and Blogspot still encompass the vast majority of blogs on the internet, both of the afformentioned free services are too cluttered with spammy blogs and blogs that …
I suspect you are not actively enhancing the TrackbackValidator so I hope you can detail a bit of the code. The validator is doing a fantastic job of catching the trackback spam. However, it is doing it late in WordPress’s trackback processing. My admin account gets an email for every comment and trackback. Unfortunately, it is getting emails for trackbacks that the validator is capturing. Given that the validator has determined it is spam, I’d love it is I never got the email that the trackbackc had been generated in the first place.
I’m sure others want the email so they can oversee the validator in case it makes an error but for me, trackbacks are a low priority and I’d rather have the validator take care of things for me.
Could you explain a bit about the plugin so I might change it to prevent emails to my admin account for captured trackbacks ?
[...] Here is the link: http://seclab.cs.rice.edu/proj/trackback/trackback-validator-plugin/ August 30 2006 rliang No comments Filed under: General [...]
I’m starting to get a lot of trackbackspam, and I wondered if you had plans to upgrade this plugin to be compatible with WordPress 2.3.x+? Your last build says that it’s compatible with 1.5+, and the last build date was 2006. Is this version 2.3.x compatible natively?
Use A Spam Filtering Tool To Manage Spam And Save Hours Everyday
For most of us, changing our primary email address to get rid of spam is not really an option. This is because our email addresses are known and used by many of our contacts and may also be printed on business cards and other material. We certainly don…
Is there an updated plugin available? I’m using wordpress 2.2.
Very cool tool.
Thanks.
[...] Trackback Validator Plugin(http://seclab.cs.rice.edu/proj/trackback/trackback-validator-plugin/) [...]
I wanted to add a little more function to avoid both comments and trackback spams to my blog, and I looking down WordPress Codex page then found this trackback validator plugin.
[...] My bad!!! July 13, 2006 Posted by stormpeak in General. trackback Well, for some reason, before I upgraded to the latest version of WordPress, I couldn’tlocate where to moderate comments (RTFD, Bill!!!). Anyway, I was getting swamped by spam (I now hate anything poker, backgammon, or gambling-related, let alone the “discounted meds” and “enlargement pill/patches”), and just finished manually deleting 1,087 spam comments!!! But, now I’ve installed the WordPress plugin, “Trackback Validator”, and not only has the spam stopped, but my blog has gotten much easier to maintain. My apologies to those few who have made comments to my posts, and hopefully I’ve got a handle on it now. [...]
trackback seo
Some companies pay $5 per permanent reciprocal links, where two sites maintain a permanent link to one another, often with anchor-texts or a review.
Go figure what the value of a reciprocal on a ‘hot’ topic is worth. For a serious networker…
Weight loss
Diet Products and Weight Loss Supplements at Discount Prices. Save 50-70% on quality products.
[...] So how to prevent trackback spam? Try Spam Trackback Validator plugin. [...]
natural penis enlargement
natural penis enlargement
[...] Patrick D’appollonio de Marlex Systems me avisa de la existencia de un plugin que valida los trackbacks falsos. Se llama “Trackback Validator” y con tan solo instalarlo ya nos filtrará los comentarios en forma de TrackBack falsos. De todas formas puedes configurar dos opciones en “Opciones > Trackback Validation” ¿Eres nuevo por aquÃ? Te recomiendo suscribirte al canal RSS del blog para leerlo a través de un lector de Feeds cuando quieras. [...]
epic wealth systems
Heh– I’ m headed for London tomorrow for a DRM meeting organized by Suw Charman– some other blogospheroids who’ ll be there are Cory Doctorow , Simon Willison , and James Cox (Imajes). Today Tom Morris tells me that Tech Crunch’ s Michael Arr…
advertising and publicity
Please Note: Comment Moderation Maybe Active So There is No Need To Resubmit Your Comments Social Network Subscribes to feed Stumble this site main post Add to my Technorati favourite August 2008 M T W T F S S« Jun 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 …
[...] Trackback Validator Plugin:Performs a simple and effective test to verify authenticity of trackbacks. [...]
Hello!
WOW! Greate plugin!!
Is it plugin compatible to WP 2.6?
Regards,
AlexG
http://www.freshmobile.us
[...] Leider musste ich vor ca. 2 Wochen mit dem ersten Spam-Trackback Bekanntschaft machen. Also bin ich auf die Suche nach einer Abwehr gegangen. Bei Trackback Spam Resources hab ich dann auch recht schnell das Richtige für dieses Problem gefunden. Das Plugin Trackback Validator. Installiert wird es wie immer: Downloaden, entzippen und in den Plugin-Ordner von WordPress (wp-content/plugins) hochladen. Im Adminbereich aktivieren. Unter Optionen findest Du einen Bereich ‘Trackback Validation’. Die Einstellungen sind hier auf der Abbildung zu sehen. Von da an prüft es ob der Trackback berechtigt ist und zu dem entsprechenden Bericht passt. Trackbacks sind automatische Benachrichtigungen über Berichte anderer Blogs, welche einen Link zu einem speziellen Bericht setzen. Und was soll ich sagen… Es ist sehr erfolgreich! . [...]
[...] The Spam Viewer allows you to delete or rescue any comments marked as Spam out of your database. All comments marked as Spam in the WordPress table comments is listed below and from the plugin Trackback Validator in the table wp_data. [...]
[...] The Spam Viewer allows you to delete or rescue any comments marked as Spam out of your database. All comments marked as Spam in the WordPress table comments is listed below and from the plugin Trackback Validator in the table wp_data. [...]
Your Article Was Hand Picked For Sydication On:…
I liked this article so much I have chosen to syndicate it…