# WordPress Comment Spam

**URL:** https://meta.discourse.org/t/wordpress-comment-spam/291442
**Category:** WordPress
**Created:** [January 12, 2024, 3:49pm UTC](https://meta.discourse.org/t/wordpress-comment-spam/291442 "2024-01-12T15:49:26Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![jordantrizz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jordantrizz/32/328273_2.png) [@jordantrizz](https://meta.discourse.org/u/jordantrizz)
#### Post date: [January 12, 2024, 3:49pm UTC](https://meta.discourse.org/t/wordpress-comment-spam/291442/1 "2024-01-12T15:49:26Z")

</div>

Hello,

When using the [WP Discourse](https://github.com/discourse/wp-discourse) plugin, the endpoint /wp-comments-post.php is still active and can be used to post WordPress comments via POST by mostly bot traffic to spam comments.

Did I miss a setting in the plugin to disable this?

EDIT: For the time being I’ve done the following to stop these requests.

```plaintext
<?php 

function disable_wp_comments_post() {
    if (basename($_SERVER['PHP_SELF']) === 'wp-comments-post.php') {
        status_header(403);
        die();
    }
}
add_action('init', 'disable_wp_comments_post');

```

---

<div class="post-metadata">

### Author: ![angus](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/angus/32/341715_2.png) [@angus](https://meta.discourse.org/u/angus)
#### Post date: [January 12, 2024, 6:47pm UTC](https://meta.discourse.org/t/wordpress-comment-spam/291442/2 "2024-01-12T18:47:59Z")

</div>

Hey @jordantrizz, could I just confirm you have Discourse comments enabled (i.e. “Enable Discourse Comments” in the “Commenting” section of the [WP Discourse](https://github.com/discourse/wp-discourse) admin is checked)?

---

<div class="post-metadata">

### Author: ![jordantrizz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jordantrizz/32/328273_2.png) [@jordantrizz](https://meta.discourse.org/u/jordantrizz)
#### Post date: [January 12, 2024, 7:00pm UTC](https://meta.discourse.org/t/wordpress-comment-spam/291442/3 "2024-01-12T19:00:37Z")

</div>

Yes, I do have this checked.

---

<div class="post-metadata">

### Author: ![angus](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/angus/32/341715_2.png) [@angus](https://meta.discourse.org/u/angus)
#### Post date: [January 15, 2024, 2:15pm UTC](https://meta.discourse.org/t/wordpress-comment-spam/291442/4 "2024-01-15T14:15:15Z")

</div>

Hey @jordantrizz thanks for your patience. I wanted to review this again in light of changes made last year.

After reviewing this again, this is in fact a desired aspect of the [WP Discourse](https://github.com/discourse/wp-discourse) system, to allow for flexibility in how folks manage native Wordpress and [WP Discourse](https://github.com/discourse/wp-discourse) comments (e.g. some people use both at once).

To administer Wordpress comments, including the use of `/wp-comments-post.php`, please use the native Wordpress settings in Settings \> Discussion e.g. “Allow people to submit comments on new posts”.

For further context on this see for example

> [@Oddity: A Wordpress comment was posted while using WP Discourse](https://meta.discourse.org/t/oddity-a-wordpress-comment-was-posted-while-using-wp-discourse/254045):
>
> I ran into an oddity this morning. I’m running Wordpress and using WP Discourse for comments. Despite having this setting enabled, I had three spam comments in my WP dashboard. How is a spam bot or anyone able to post a comment on Wordpress when comments are handled with WP Discourse? There’s no place to even enter data to be accepted as a comment? Much less for it to land in my dashboard. I’m bewildered. P.S. Within Wordpress I did just go set:

---

<div class="post-metadata">

### Author: ![jordantrizz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jordantrizz/32/328273_2.png) [@jordantrizz](https://meta.discourse.org/u/jordantrizz)
#### Post date: [January 16, 2024, 6:56pm UTC](https://meta.discourse.org/t/wordpress-comment-spam/291442/5 "2024-01-16T18:56:10Z")

</div>

Thanks, and perhaps this should be documented somewhere because I was under the assumption if you shutdown the WordPress comments that the Discourse widget will not be displayed.