When someone visits your WordPress site and makes a comment, they become commenters. As a commenter, a visitor will get 3 distinct cookies set on their local machine so that with each comment they don’t have to re-enter their name, email and URL over and over again. The 3 cookies are:
By default, comment cookies should last for slightly under one year from when they were set, or until the commenter clears them off their local machine.
The general flow for comment cookies and spam protection is:
A savvy anti-spam plugin (that can be quite simple really) can check that a browser is humanoid, rather than spam AI, by dropping the cookie and checking to see if it is saved on the local machine [scenario 1].
In instances where the AI is more than just the simplest of scripts, cookies will be saved and returned upon request, defeating any checks for existence. The basic cookie test is just not enough to defeat most spambots.
In scenario 2, the time a cookie is dropped is compared to the time a comment is submitted. Allowing for speedy humans as a best case scenario, the server will diff the two times and compare to a speedy human. In other words, if somehow a name, email, URL and comment text is all submitted faster than a speedy human could possibly do it, it’s obviously a spambot just dumping text as fast as it can.
The only way a spambot can defeat the time measures of scenario 2 is to delay arrival on page and submitting of form fields. While there are some that can overcome this - it’s very, very few.
So how do you implement commenter cookie checking to stop spambots?
Install the Cookies for Comments plugin using our How to Install Plugins procedure: 1)https://wordpress.org/plugins/cookies-for-comments/
Be sure to clear cache (browser, WP plugins and hosting) before testing. However, as a human, you should be able to comment as normal, without feeling any odd pains or inconveniences, while spambots are not.