https://lhero.org/portfolio/lh-zero-spam/ Digital Sovereignty for everyone Thu, 15 Oct 2026 01:12:16 +0000 hourly 1 https://lhero.org/portfolio/lh-zero-spam/#comment-1537349 Thu, 15 Oct 2026 01:12:16 +0000 https://lhero.org/?p=142#comment-1537349 Two small fixes. The direct wp-login.php check tested isset($_GLOBALS[‘pagenow’]), a misspelling of $GLOBALS, so that condition could never match; the other conditions in the same check still caught wp-login.php, so login protection was not affected. wpmu_validate_user_signup() read $wp without declaring it global, which raised an undefined-variable warning on every wp-signup.php validation and meant the REST-request exemption never applied; it now declares global $wp like the comment, BuddyPress and WooCommerce handlers do, so signups made through the REST API are exempt from the JavaScript check as those handlers already are.

]]> https://lhero.org/portfolio/lh-zero-spam/#comment-1537348 Thu, 15 Oct 2026 01:11:13 +0000 https://lhero.org/?p=142#comment-1537348 Requests refused by LH Zero Spam now return 403 Forbidden instead of 500 Internal Server Error. A login POST to wp-login.php without a valid nonce (both the early check and the authenticate filter), a comment without one, and a BuddyPress signup without one were all stopped with wp_die() and no response code, which WordPress sends as a 500, so bot credential-stuffing showed up as server errors in the access logs and monitoring. The messages are unchanged.

]]>