When I was new to web development, I bought a domain, put it live, and started to run subdomains off of it. It’s not an unusual method of staging projects before shipping them to their own live domains. I wasn’t expecting there to be any fuss. I certainly wasn’t expecting spam.
I made a mistake, though. I didn’t toggle the privacy protection add-on (since amended for that domain).
That’s how I first learned that DNS (domain name servers) publicly publish lists of newly registered domains.
Protecting your DNS Privacy
(Disclaimer: I use affiliate links for the brands I mention from this point on, but this article was going to be written mentioning those brands either way – it’s just what I prefer to get a website up and going quickly. It’s more of a case of ‘well, I was going to advertise for them anyhow…’)
After that first call, I checked out my domain using WHOIS (describe what this is), and there it was. All of my contact information used to register on Namecheap was right there for the taking.
Minutes later, I’d gone back to Namecheap and opted into the privacy option – I’ve been using them since 2017, and, while I’ve changed hosted periodically, this is something I’ve kept consistent. Honestly, while I can’t quite recall if you had to actively opt-in for privacy protection at the time, privacy protection is the default option now, and users actively have to opt-out in order to end up in that same situation. There are additional measures one can take to secure their domain privacy beyond that point, but setting up WHOIS privacy is the big one to note.
Fast forward to a few years later, and the launch of the Garden Nook Studio website. Feeling safe in the knowledge that I’d confirmed the presence of domain privacy on my website, I spun up the website on Siteground (affiliate), using a StudioPress Genesis Pro (affiliate) child theme called Magazine Pro, which is configured for a site that has a lot of articles (I liked that it was simple, clean and responsive enough that I could launch it with very little customization while I got my branding figured out in the meantime, but that’s another article).
Then, I waited for the internet to show me the gaps in my setup.
It didn’t take long at all.
The Siteground Security Plugin, installed for free if you have a Siteground account (many hosting providers have this sort of deal for their customers) has a handy Activity Log feature that you can switch on. [ note: Wordfence also has this option available, by the way; but I wanted the initial coverage while it was in Learning Mode, and deactivated the first plugin once Wordfence was ready. Keep in mind, Wordfence has a small learning curve. In addition security plugins on WordPress sites work best when you only have one working at a time in order to avoid conflicts. In this case, think of it as hiring a contractor to do basic maintenance while an architect is planning to remodel your home.]
Here’s what the activity log gives you:
Timestamp – When the activity occurred
Visitor Type – Human or Googlebot – generally, is it a real visitor, or did a search engine just ping your site?
IP Address – The internet protocol address of a visitor. This value is one of the key indicators that standard web analytics uses for tracking, although an effort is made, in that case, to anonymize user data. This is also the value that makes your web traffic trackable, and identifies individual users (I used NordVPN’s IP Lookup tool to do this)
Page Visited – a log of which page was visited. This can also be an indicator of bad actors on your site if its a human hitting up non-standard links
Response – Whether the hit was successful, using an HTTP code.
I was getting a lot of hits from two locations- one in Ohio, and the other in Kansas. They seemed to be running through a checklist. I could tell this because they were hitting up REST API endpoints rather than the links I had set up internally (/wp-**json/wp**/v2/posts, being one example)
This time, my phone never rang.
However, my contact form, set up for potential clients to reach out, started to get some activity.
Ah. I’d set up the website so quickly that my contact forms didn’t have anti-spam setup.
I used the default form plugin for the theme I chose (which I found to work nicely, so I kept it), so I looked up the security settings for WP Forms. WP Forms has a pretty extensive set of instructions for securing your website against spam. The first measure they recommended was to go to the specific form I wanted to edit (my contact form, in this case), and go to Settings.
From there, I could scroll down and enable the anti-spam protection option. This gives the plugin permission to add a token to each form submission, which a bot won’t do – very likely in the case of the two aforementioned service providers looking to sell web services.
It’s also useful to have a secondary line of defence that’s a bit more visible, as a deterrent as well as an anti-spam device. A tool such as reCAPTCHA is well known for this use case.
To set up and activate reCAPTCHA (you can register one for free with Google), save and close the form currently you’re updating, then navigate over to WPForms > Settings in your main dashboard, and select the CAPTCHA tab. Here, they have two form fields- one for a public API key, and the other for the secret key.
WPForms has a walkthrough available for registering a reCAPTCHA – I’ve gone over how Google tools often require a certain level of fluency with their user interface (UI) to use them effectively in a previous article. I found this one to be pretty simple, but immersion has that effect. Essentially the walkthrough requires you to head over the Google Checkbox v2 reCAPTCHA and register it to your domain, after which you can take the two generated keys, now attached you your Google Account, and paste them into the WPForms fields as needed.
Final thoughts
While there are a few moving parts to be aware of, and this focuses on one specific form plugin of many for WordPress, WordPress itself continues to represent a huge portion of the market- 43% of all websites use it in March 2022. The specific setup I’ve outlined above has kept my site clear of spam since activating it. As a first line of defense, I’ve been pretty satisfied.
An addendum on privacy: While wrapping this article up I went to check whether the offending spammer was using a VPN, (Virtual Private Network) to protect his privacy, and prevent being tracked down by irritated contacts like yours truly. It turns out that yes, he absolutely was. I kept track of the IP address as a baseline to figure out where my security could be improved, but he still has a right to privacy; but also so do I, and so do you.
At the end of the day, a VPN is a tool that anyone can use to encrypt their web traffic; for instance, it’s a really strong way to protect your personal data while using a public Wi-FI network. NordVPN, for example, is having their 10th-anniversary event (affiliate) from now through to Wednesday, March 16, 2022 for 70% off (if you missed this offer, don’t worry – they run really good promotions all the time.
Speaking of contact forms, it’s becoming more and more critical in the age of GDPR and similar data privacy legislation, to be absolutely clear on what data you’re collecting from your visitors, and how it’s being used. I personally used Termageddon (not an affiliate link, check them out anyways!), which let me go through a questionnaire regarding my setup and data privacy plan, generating a custom policy that I could embed in my website. I’ll cover this topic more in the future, but it’s something to consider if you’re in the early launch period of your website, and want to ensure your bases are covered for when you grow.