# WordPress Comment Spam

**URL:** <https://meta.discourse.org/t/wordpress-comment-spam/291442>\
**Category:** WordPress\
**Created:** [January 12, 2024, 3:49pm UTC](https://meta.discourse.org/t/wordpress-comment-spam/291442 "2024-01-12T15:49:26Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![jordantrizz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jordantrizz/32/328273_2.png) [@jordantrizz](https://meta.discourse.org/u/jordantrizz)\
**Post date:** [January 12, 2024, 3:49pm UTC](https://meta.discourse.org/t/wordpress-comment-spam/291442/1 "2024-01-12T15:49:26Z")

</div>

Hello,

When using the [WP Discourse](https://github.com/discourse/wp-discourse) plugin, the endpoint /wp-comments-post.php is still active and can be used to post WordPress comments via POST by mostly bot traffic to spam comments.

Did I miss a setting in the plugin to disable this?

EDIT: For the time being I’ve done the following to stop these requests.

```plaintext
<?php 

function disable_wp_comments_post() {
    if (basename($_SERVER['PHP_SELF']) === 'wp-comments-post.php') {
        status_header(403);
        die();
    }
}
add_action('init', 'disable_wp_comments_post');

```

---

_[View the full topic](https://meta.discourse.org/t/wordpress-comment-spam/291442)._