Chris Aldrich

I'm sorry you've run into this issue. I can't help but wonder if most of the spam is really pingback spam? Much of what you've gotten likely isn't arriving via webmention as I see the following header in your page:
<link rel="pingback" href="https://webmention.io/www.miriamsuzanne.com/xmlrpc" />

My guess along with some minor sleuthing is that the entirety of the spam you're seeing is of the pingback variety as the mechanism by which webmention works is mean to actively decrease the amount of unwanted spam. Vanishingly little Webmention spam has been seen in the wild.

Removing the pingback link from the header of that particular page (or others that might get linked to with heavily trafficked sites like CSS-Tricks which are often pirated) should solve your immediate problem. Hopefully those who are working on additional anti-spam features will add to these measures to further mitigate this sort of issue for the broader publics' use and adoption. I've personally experienced this sort of "attack" at least once in the pingback space and another using the even older refbacks specification. On my small personal site, I leave them all on however, particularly for the small slice of academic blogging community that still uses pingbacks and the benefits generally outstrip the annoyance. Naturally your mileage may vary and you may consider turning them off.

Of course, you'll probably also realize that the reason the CSS-Tricks notification was caught in spam was because it also came in as a pingback and not by webmetion. (I'm pretty sure that they don't have webmention set up to send them, so their site would have only sent a pingback.)

Many of the older systems, including WordPress which are frequently used by these same sorts of pirates, will still send/trigger pingbacks. Within the IndieWeb space, most sites explicitly sending webmention notifications will include h-cards with author names and timestamps which is part of why Max Böck’s filtering solution works well.

On the positive side, I wonder if this sort of notification behavior might help sites like CSS-Tricks to track these sort of bad actors for help in potential take downs of this sort of piracy?

@khurtwilliams POSSE for WordPress can be tricky in part because, compared to most other IndieWeb pieces for WordPress, there are multiple different and varying ways to do it. Using one method could potentially conflict with another depending on how you set things up, though I think these are relatively few.

Your best bet is to hop into the #WordPress channel of the IndieWeb chat https://indieweb.org/discuss and ask for help, particularly to discuss the specifics of what you'd like to do and what you expect.

In general, the more control and flexibility you want over the display of your POSSE posts, the more set up and work you have to put into it (e.g. SNAP), while the less control you have the more simple the set up (e.g. JetPack Publicize).

Things like Brid.gy publish functionality (or via the Brid.gy Publish plugin) can be more finicky for POSSE copies to silos because Brid.gy is parsing your site for the proper data to publish. (It does have a preview button built in to do manual tests if you need to.) This means that if your WordPress theme doesn't have the correct microformats markup (and often they don't), then you can get spurious results, particularly when it comes to crossposting photos.

Most of the main POSSE plugins and tech are very stable in fact, but they do require that you do a bit of reading and understanding what they do and don't do and what you can and can't control with them. Most all of them have GitHub repositories that you can post issues to and almost all the devs, maintainers, and community are happy to help you out and/or make changes to make the UI and documentation better.

As for backfeed from Brid.gy, it generally requires that the URLs of your post and the syndicated post have matching permalinks to be able to match the two up to send you the webmentions properly. You may have changed your settings, but one piece you appear to be missing is the Syndication Links Plugin which allows you to add u-syndication links to your posts so that Brid.gy knows which ones to send your responses to. Much of this is documented at https://indieweb.org/WordPress_with_Bridgy It also looks like you don't have either an h-card or the appropriate rel-me links on your pages for Twitter, Facebook, et al. Brid.gy is pretty well documented, so you may want to take a look at some of the options there directly. https://brid.gy/about If it helps, you can do a lot of interactive stuff with Bridgy by manually creating posts with specific html in your posts directly. Understanding how to do this can be helpful later when you switch to using a plugin to help automate part of those processes.

I'm sure I've got a few odd posts from ages ago when I tested things out, but when you say "I can also see from some of the failed posts on your website that you may experience the same issues." I'm curious which particular posts you mean? To my knowledge things I intend to syndicate out are currently working as I expect them to (aside from one quirk that occasionally spams the Indieweb chat with micropubbed posts which continually redirect, but that's specific only to me because of some experimental code I've been running). It is the case that I don't always syndicate everything to each and every silo target I could. I do very much pick and choose which things to syndicate to particular networks.

We'll help you get there yet!