search

hCaptcha / hcaptcha-wordpress-plugin

hCaptcha.com support for Wordpress (Plugin)
GNU General Public License v2.0
80 stars 32 forks source link

Hooking into WordPress' Comment forms before Akismet makes API calls #313

Closed mudge closed 9 months ago

mudge commented 9 months ago

We introduced hCaptcha onto a site in an attempt to head off spammy comments before they are processed any further, including being analysed by Akismet. However, it seems that Akismet uses the preprocess_comment hook while the hCaptcha plugin uses pre_comment_approved which fires after Akismet has made its API call.

Is there a way to restructure things such that hCaptcha fires before Akismet, preventing the comment submission but also stopping it before it gets processed by Akismet potentially using up an API call?

mudge commented 9 months ago

Looking at Akismet's and WordPress' source code, it doesn't look like moving hCaptcha's check to preprocess_comment would particularly help unless you forcibly killed the script with wp_die() as the API for preprocess_comment doesn't let you return a WP_Error as with wp_allow_comment.

Akismet has a branch that does something similar if the "discard" option is true which seems a little extreme but might be the only way to ensure no other plugin processes the comment data.

kagg-design commented 9 months ago

Thank you for reporting the issue. I have added the fix in this commit.

v3.9.0 will be released in days.

mudge commented 9 months ago

Thanks for the prompt response and fix.