Listing inquiry forms are vulnerable and targetted by spammers

[dknauss]

Problem: The mail forms baked into single listing page templates by default are a big source of spam that frustrates the end user and inhibits their ability to use WP Listings as an effective lead generation tool. Spambots now search for the forms and exploit them even if they are hidden via CSS. The inquiry forms cannot be removed through the WP Listings plugin's global settings, so there is no simple solution to the spam problem for end users.

Proposed Solutions:

• Remove the inquiry forms from the default listing page template.

  Additionally:

  • Add a global setting to enable/disable insertion of the default mail form or arbitrary code (e.g. alternative form solutions) at a designated point in the default listing page template.
  • Add a global setting to use WordPress comments instead of a mail form in listings.

[bhubbard]

I agree this is a pretty big problem. I agree with @newlocalmedia to remove the default form offered. I suggest if no form is provided then we default to WordPress comments.

Also I'm not really a big fan of having users create forms for every single property. Gravity Forms & Contact Form 7 both offer ways to pre-populate the form with information such as the url of the page, title of the property, etc. This means the client could just have one form set and used for all property pages but still see which property the form submitter was on when filling out the form. Maybe we can just offer a global setting for the form.

The order would be like this:

• Default Install - WordPress Comments
• Global Form Shortcode Provided - Same form across all properties
• Form Shortcode provided on a single property would then always over-ride either of the two if provided.

+1 to have this worked on before other issues.

[davebonds]

Global form shortcode added in ee4b299

Default form still shows instead of using wp_comments

[bhubbard]

Great Update. Before closing this out we may want to consider adding two more things:

1. Add Akismet support to the default form, as this would really help with spam, and WordPress comes with it.

2. As I see it there is still no way to use WordPress comments without overriding the template. So maybe we need to have a option letting the user choose between the form field or WordPress Comments. We would need to decide if this is a global option, or option per listings.

[amcn84]

Google reCaptcha was added to version 2.0.2 to address spam concerns. The form will submit as usual if they don't satisfy the captcha but won't actually send any data.