Top Commentators List Hijack

For those of you who use the Top Commentators plugin, beware of name hijacking. Jalaj first wrote about this last month at Top Commentators List Hijack, and recently I’ve been suffering from this myself.

To briefly explain, the plugin creates the top commentators list by counting the number of comments made per name which is easily forged, by accident or on purpose. It then links the name using the last URL given on that name’s comment. So all you need is someone to forge someone else’s name and use a different URL and they get a nice little, usually no followed, link from your site.

I’d forgotten about this (my heads pretty fuzzy right now with this cold!) but this morning suddenly twigged about comments sitting in my moderation queue, plus one that I’d actually allowed through. So a quick line change later in the plugin and it’s all working again, instead it counts the number of comments made per email not per name, the email address being the one thing no one else can copy.

So big thanks to Jalaj for making me realise this, and if you want the modified plugin you can grab it here – Show Top Commentators Modified.

You may also like...

16 Responses

  1. Si Philp says:

    I hate spammers with a vengence. Anything that stops these low lifes getting some dodgy link on a good website is always a good thing.

    I’ve had alot of referral spam lately, if it’s not one thing it’s another. I have started blocking IP ranges now 🙁

  2. Sarah says:

    Spam is certainly getting to be a bigger and bigger problem. I’ve noticed more humanised spam (as opposed to automated) appearing on particular posts.

  3. Jalaj says:

    Thanks Sarah, for bringing out the modified plugin. I was not aware of this branch (or whatever we call it, as it is different from that available at wordpress.org). I will include reference to this version and the modified plugin from you site…
    Congratulations for being the first one (at least in my knowedge) to implement hack-proof Top Commentator List

  4. Sarah says:

    No problem Jalaj, thanks for bringing the issue to my attention 🙂

  5. Abas says:

    Hi, Sarah

    How are you?

    You have an interesting blog. I do not use the top commentators WP plugin on my blogs but anyway, thanks for the heads up. 😀

    Abas
    aispecial.blogspot.com

  6. Jenny says:

    I noticed this. That’s why I took it off my site. Plus I haven’t been getting any good commenters anyway. Just spam. No real people. So I see no point in it anymore

  7. Sarah says:

    Jenny, you get tonnes of comments! Or do you just wonder whether they’re actually interested in what you’ve written, or just commenting for the sake of getting a link back to their site?

    I know the plugin allows you to blacklist certain names, of course now that should really be email addresses. If someone isn’t actually adding to the comments then why let them into the prestigious top commentators list? 😉

  8. Ian says:

    Thanks Sarah for this pickup and modified plugin. I had wondered myself what happened if more than one user with the same name was leaving comments.

  9. Sarah says:

    No problem Ian 🙂

  10. Anon says:

    Woow thanks! I have been suffering from this myself. Bloody spammers!

  11. Sarah says:

    No problem, although I’d rather have your real name in the comments 😉

  12. Kate B says:

    Wow. That is a pretty big issue with the plugin. Man… if I wasn’t a nice girl I’d be really tempted to try that out. But alas… my morals prevail 🙂

  13. Sarah says:

    Kate, I know the feeling. I’m surprised it’s not been written about more to be honest. I guess a lot of people aren’t realising the plugin is being abused.

  14. amrita says:

    thanks for this pickup and modified plugin. I had wondered myself what happened if more than one user with the same name was leaving comments.

  1. Wed, 30 April, 2008

    […] More information on my post at top commentators list hijack. […]

  2. Wed, 30 April, 2008

    […] Sarah explained last month : To briefly explain, the plugin creates the top commentators list by counting the number of […]

Leave a Reply

Your email address will not be published. Required fields are marked *