Hi Hector and Michael,
I can shed some light on this. After receiving Michael’s support request and debugging info, we identified the issue.
Right now when WordPress Popular Posts does an AJAX call, it doesn’t identify itself as an AJAX request by using the X-Requested-With: XMLHttpRequest header. That’s the de facto standard for identifying AJAX calls. You might want to check out this thread: http://stackoverflow.com/questions/1885847/jquery-no-x-requested-with-xmlhttprequest-in-ajax-request-header
Hector:
In the main file on line 1378 you have:
xhr.setRequestHeader( "Content-type", "application/x-www-form-urlencoded" );
After that, add something similar to this:
xhr.setRequestHeader( "X-Requested-With", "XMLHttpRequest" );
That’s all! *You’ll need to check the specifics, and test appropriately, but that’s the general gist.
As part of WP-SpamShield’s support for all third party contact form plugins, WP-SpamShield checks the admin-ajax.php POST requests. (We can’t just check the DOING_AJAX constant in WordPress, as other non-AJAX POST requests can come in through that endpoint.)
Currently (as of the current version 1.9.9.9.5), WPSS ignores all requests coming in through admin-ajax.php (at least for the relevant test that is currently causing the block) that are identified as AJAX with the X-Requested-With: XMLHttpRequest header. We’ll also add specific whitelisting for WPP in the next version, but if you change the params in the future, the XMLHttpRequest will help across the board (likely with other plugins as well that deal with security).
We also have a guide for other plugin developers, and you can contact us here as well: https://www.redsandmarketing.com/plugins/wp-spamshield/hooks/
Michael and Hector:
There is a temporary workaround that can be used: Disable anti-spam for miscellaneous forms. However there are drawbacks, so we don’t recommend it: It will disable anti-spam for any third party forms (other than CF7 and Gravity), as well as protection against many XML-RPC based attacks, such as brute force amplification attacks and Pingback based DDoS attacks, etc. See here for more info.
Hope this helps. Feel free to contact us for further help/info.
— Scott
