Overview
Dprime Comment Guard protects the native WordPress comment form with layered checks that stay invisible to real visitors.
Requirements
- WordPress 6.4 or newer
- PHP 8.2 or newer
Installation
- Upload the dprime-comment-guard folder to /wp-content/plugins/.
- Activate Dprime Comment Guard in WordPress.
- Open the plugin settings and review the available options.
Using the plugin
- Honeypot field that only bots fill in, active from the moment you activate the plugin
- Signed timing token that turns away submissions arriving too fast or too late
- Rate limiting per IP address with a configurable window
- Optional challenge question with the answer checked on the server, never sent to the browser
- Optional Cloudflare Turnstile with fail closed verification
- Link limit, minimum and maximum length rules, and a blocked terms list
- Choice of what happens to caught comments: mark as spam, move to trash, or reject with a message
- Option to remove the website field from the comment form
- Option to disable pingbacks and trackbacks
- Blocked counters per protection so you can see what is working
- Skips logged in users by default
- Editable visitor messages, ready for TranslatePress on multilingual sites
Data and cleanup
- 2 WordPress settings
- Optional external service: Cloudflare Turnstile
Retention: kept until the plugin is uninstalled. Uninstall policy: delete the plugin-owned data declared above.
Frequently asked questions
Does it work with any theme?
Yes. The plugin hooks into the native comment form that themes render through comment_form, and the added fields inherit the theme styling.
Will real visitors see a captcha?
Only if you enable the challenge question or Turnstile. The honeypot, timing token, rate limiting, and content rules work without asking visitors anything.
What happens to caught comments?
Definite bot signals follow your bot action: spam folder, trash, or outright rejection. Checks a real visitor could fail show a message with a back link so they can fix the comment and resubmit.
Does it work with page caching?
Yes. The timing token is the only cache sensitive part; keep its lifetime at or above your page cache lifetime and cached forms keep working.
Does it replace Akismet?
It works differently. Akismet scores content against a remote service, Comment Guard blocks the submission mechanics bots rely on. They can run side by side.
Does it slow the site down?
No. Checks run only when a comment is submitted. Nothing is added to normal page loads beyond one hidden field and a small style rule on pages with open comments.
Updates and access
This complete free release can be downloaded directly. Install Dprime Core for automatic catalogue updates.