Comment Spam Protection
What it helps you do
Keep spam comments out of Comments → Pending and stop the "Please moderate" emails they trigger. It works on every post that's open to comments, including WooCommerce product reviews, and on sites that also run Akismet or Simple Cloudflare Turnstile.
Real visitors see no change: no puzzle, no checkbox, no extra step.
What happens automatically
When someone who isn't logged in sends a comment, Dirigible checks it first:
- Comments sent by scripts are turned away. Most comment spam is posted straight to the site by a script that never opens the page. Those, and comments posted from another website, get a "Your comment wasn't sent because it looked automated" page. Nothing is saved and no email goes out.
- Comments that look automated go to Spam. A comment sent within three seconds of starting to type, one with a web address in the Name field, or one that filled in a field people can't see is kept under Comments → Spam instead of Pending. No moderation email is sent for it.
- Everything else carries on as before. Your Settings → Discussion choices, Akismet and Turnstile decide what happens next, as they always have.
Logged-in users skip these checks. Replies you write from the Comments screen aren't affected either.
Where to look
- Comments → Spam lists the comments Dirigible held back. If a real comment ends up there, hover over it and choose Not Spam.
- Comments → Pending still holds the comments that passed and are waiting for approval, as set under Settings → Discussion (for example "Comment author must have a previously approved comment").
The first 60 days
Pages saved in the site's cache before the update don't have the new check yet, and caches can keep them for weeks. For the first 60 days, comments from those pages are treated as they were before. After that the check is fully on, with nothing to do on your part.
Visitors with JavaScript turned off can still comment. After the first 60 days their comments go to Spam for you to review, instead of Pending.
Under heavy spam
If spam keeps arriving even so, it's coming from bots that drive a real browser. Add the Simple Cloudflare Turnstile plugin, turn on its WordPress Comment option and enter its Cloudflare keys. With Dirigible Optimize active, Turnstile loads only when a visitor starts using the comment form, so other visitors don't download it.
If a post doesn't need comments, turn them off: edit the post, open Discussion in the sidebar and untick Allow comments. Settings → Discussion → Allow people to submit comments on new posts sets the default for new posts.
Related
- Gravity Forms has its own spam checks for contact forms.
