Comment Validator

Developed by

Download

Plugin Description

Validates comments using a multi-layer scoring engine.

Description

Comment Validator protects your site from spam by replacing simple pass/fail checks with a cumulative scoring engine. Each comment is assessed across multiple layers — honeypot detection, secure time tokens, JavaScript verification, user interaction tracking, rate limiting, IP reputation, and content analysis including link density, spam keywords, all-caps ratio, repeated characters, duplicate detection, and disposable email domains.

Each check contributes a configurable weight to a total score. When the score reaches the moderation threshold the comment is held for review; when it reaches the spam threshold it is marked as spam and the submitting IP has its reputation score incremented, making future submissions from that address increasingly likely to be caught. IP reputation scores decay daily so legitimate users are not permanently penalised.

All weights and thresholds are adjustable from the settings page without touching code. The spam score and triggered rules for each comment are displayed directly in the comments list, making moderation triage quick and transparent.

This plugin is multisite compatible; each site can be set to use network settings or locally defined ones.

Installation

  • Download the latest release of the plugin from GitHub.
  • Upload the entire zip file using the Plugins upload function in your ClassicPress admin panel.
  • Activate the plugin.
  • Configure relevant settings via the configuration page in the admin control panel (azurecurve menu).

Frequently Asked Questions

Can I translate this plugin?

Yes, the .pot file is in the plugins languages folder/; if you do translate this plugin, please sent the .po and .mo files to [email protected] for inclusion in the next version (full credit will be given).

Is this plugin compatible with both WordPress and ClassicPress?

This plugin is developed for ClassicPress, but will likely work on WordPress.

Changelog

Version 3.1.1

  • Update readme.md and remove readme.txt (not required for ClassicPress).
  • Update azurecurve menu.
  • Remove last traces of jQuery to avoid deprecation notices.

Version 3.1.0

  • Add auto-delete feature for high spam scores.
  • Add direct access check to php files.
  • Fix plugin icon and banners.
  • Fix broken heading markup on Protect Usernames settings section.

Version 3.0.4

  • Fix headings on settings tabs.

Version 3.0.3

  • Upgrade UpdateClient.
  • Update azurecurve plugins list.
  • Replace jquery with vanilla js.
  • Remove multisite functionality (plugin will still work on multisite, but no specific functionality is present).

Version 3.0.2

  • Update settings tabs and css to format th elements correctly.

Version 3.0.1

  • Update description and list of plugins.

Version 3.0.0

  • Complete rewrite of comment validation engine.
  • Replaced binary pass/fail checks with a cumulative scoring system.
  • Added configurable scoring weights and thresholds via the settings page.
  • Added rate limiting with configurable submissions per minute.
  • Added secure server-side time token (replaces plain timestamp).
  • Added JavaScript execution verification.
  • Added user interaction time tracking.
  • Added user agent check.
  • Added all-caps ratio detection.
  • Added repeated character sequence detection.
  • Added duplicate comment detection via content hashing.
  • Added disposable/spam email domain checking.
  • Added expanded spam keyword detection.
  • Added persistent IP reputation tracking via dedicated database table.
  • Added daily IP reputation decay via scheduled cron job.
  • Added spam score display in comment row actions on the comments list screen.
  • Added nonce verification on all comment form submissions.
  • Added sanitisation of all admin settings inputs.
  • Fixed admin settings page CSRF vulnerability.
  • Fixed time token being consumed on failed submissions, causing missing_token errors on back navigation.
  • Removed plain timestamp field in favour of secure server-side token.
  • Updated honeypot field to use inline CSS hiding to prevent CSS-based detection.
  • Added database table cleanup and cron unscheduling on plugin uninstall.

Version 2.1.1

  • Update plugin header for compatibility with ClasssicPress v2.

Version 2.1.0

  • Fix bug with error handling.
  • Add option for honeypot on comment form.
  • Add option to validate time delay from page load before comment can be submitted.
  • Update Update Manager to version 2.5.0.
  • Update plugin header and readme for compatibility with ClassicPress Directory v2.

Version 2.0.2

  • Update readme file for compatibility with ClassicPress Directory.

Version 2.0.1

  • Fix Update Manager View Details link (contributed by xxsimoxx).

Version 2.0.0

  • Refactor code to use namespace, improve security and improve maintainability.
  • Update language file.
  • Update Update Manager to version 2.4.3.

Version 1.3.2

  • Update readme files.
  • Update language template.
  • Fix bug with azurecurve menu.

Version 1.3.1

  • Update azurecurve menu.
  • Update readme files.

Version 1.3.0

  • Update translations to escape strings.
  • Update azurecurve menu and logo.

Version 1.2.1

  • Fix problem with load of plugin icon and banner.

Version 1.2.0

  • Fix plugin action link to use admin_url() function.
  • Rewrite option handling so defaults not stored in database on plugin initialisation.
  • Add plugin icon and banner.
  • Update azurecurve plugin menu.

Version 1.1.4

  • Fix bug with setting of default options.
  • Fix bug with plugin menu.
  • Update plugin menu css.

Version 1.1.3

  • Rewrite default option creation function to resolve several bugs.
  • Upgrade azurecurve plugin to store available plugins in options.

Version 1.1.2

  • Update Update Manager class to v2.0.0.
  • Update action link.
  • Update azurecurve menu icon with compressed image.

Version 1.1.1

  • Fix bug with incorrect language load text domain.

Version 1.1.0

  • Add integration with Update Manager for automatic updates.
  • Fix issue with display of azurecurve menu.
  • Change settings page heading.
  • Add load_plugin_textdomain to handle translations.

Version 1.0.1

  • Update azurecurve menu for easier maintenance.
  • Move require of azurecurve menu below security check.

Version 1.0.0

  • Initial release for ClassicPress forked from azurecurve Comment Validator WordPress Plugin.
  • Add option to prevent unregistered user using registered username.

Other Notes

About azurecurve

azurecurve was one of the first plugin developers to start developing for ClassicPress; all plugins are available from azurecurve Development and are integrated with the Update Manager plugin for fully integrated, no hassle, updates.

The plugins available from azurecurve are: