justintadlock/registration-honeypot

WordPress plugin for stopping most spambot registrations via a simple honeypot method.

Registration Honeypot

A plugin for stopping most spambots from registering user accounts on WordPress sites with open user registration. This plugin creates a simple, hidden field that spambots will automatically fill out. If this registration field has data entered into it, the registration process is cut off and no spam user account will be created.

This plugin isn't an end-all solution to spam registrations. It's a simple solution for one type of spam registration issue that has come in handy for me many times.

There's no configuration. Simply install, activate, and let the plugin do its work.

registration-honeypot's Issues

Bail if not on registration screen

Some plugins incorrectly call WP core hooks to display a custom registration form. See: http://themehybrid.com/board/topics/honey-pot

When this happens, we should bail and not show the honeypot fields.

Browser autocomplete

I found when using honeypots, browser autocomplete throws a spanner into the works. And for added annoyance, autocomplete="off" doesn't seem to work in the latest versions of Chrome.

Add "hidden" element to the <p> tag.

There should be a hidden property at the end of the

tag to hide the honeypot from custom pages.

Add to login form?

If one added these two lines to the constructor, it would add the hidden field to the login form as well:

add_action( 'login_form', array( $this, 'register_form' ), 99 );
add_action( 'login_form_login', array( $this, 'check_honeypot' ), 0 );

Would there be a reason not to do this? I'm thinking: if someone is trying to brute force your password, would it be wiser to use a login lockout plugin to prevent them from overloading your server with login requests or would this type of thing do just as well? Thoughts?