In reply to Andy W.

Those claims fall into "citation needed" category"

To clarify what I meant regarding google is that google is rate limiting their services so I will be surprised if a john do spammer can just run a search whenever he want without paying for it, and spammer don't like to pay as it cuts their margins (and google probably monitors for such a use).

As for detecting wordpress, you need to do it only once a year and have a DB of it. And it is much easier to identify wordpress and its version by trying to load several file and page (does anyone remove the comment yaost and W3TC insert into the HTML)

Once you have the DB you can just cross check the URLs you want to spam against the DB to know the right endpoint to send the spam to and what parameters should be included.

Your footpring suggestion are just the tip of the iceberg if that is really the direction you want to follow. If "powered by wordpress" was something that spammers actually cared to detect than changing it to "powered by drupal" would have given a perfect spam solution.

If it was so easy to avoid spam as your suggestions suggest we would have been all spam free by now. Real life suggest that such security by obscurity usually leads to hurting the valid users more then the spammers.