WordPress Comment Spam

Support WordPress

AI-generated summary

A discussion about WordPress comment spam when using the WP Discourse plugin. jordantrizz reported that the /wp-comments-post.php endpoint is still active, allowing bot traffic to post spam comments, despite using the plugin. angus inquired if jordantrizz had Discourse comments enabled, which they confirmed.

It was explained by angus that this is a desired aspect of the WP Discourse system, allowing flexibility in managing native WordPress and WP Discourse comments. To administer WordPress comments, including /wp-comments-post.php, users should use the native WordPress settings in Settings > Discussion. jordantrizz suggested documenting this, as they assumed disabling WordPress comments would also prevent the Discourse widget from being displayed.

1

Hello,

When using the WP Discourse plugin, the endpoint /wp-comments-post.php is still active and can be used to post WordPress comments via POST by mostly bot traffic to spam comments.

Did I miss a setting in the plugin to disable this?

EDIT: For the time being I’ve done the following to stop these requests.

<?php 

function disable_wp_comments_post() {
    if (basename($_SERVER['PHP_SELF']) === 'wp-comments-post.php') {
        status_header(403);
        die();
    }
}
add_action('init', 'disable_wp_comments_post');
2

Hey @jordantrizz, could I just confirm you have Discourse comments enabled (i.e. “Enable Discourse Comments” in the “Commenting” section of the WP Discourse admin is checked)?

3

Yes, I do have this checked.

4

Hey @jordantrizz thanks for your patience. I wanted to review this again in light of changes made last year.

After reviewing this again, this is in fact a desired aspect of the WP Discourse system, to allow for flexibility in how folks manage native Wordpress and WP Discourse comments (e.g. some people use both at once).

To administer Wordpress comments, including the use of /wp-comments-post.php, please use the native Wordpress settings in Settings > Discussion e.g. “Allow people to submit comments on new posts”.

For further context on this see for example

5

Thanks, and perhaps this should be documented somewhere because I was under the assumption if you shutdown the WordPress comments that the Discourse widget will not be displayed.