Kapatagan Anti Comment Spam

Description

Kapatagan Anti Comment Spam keeps spam out of your comments without annoying your visitors. There are no puzzles or “I am not a robot” boxes, and nothing is sent to outside services unless you turn on the optional StopForumSpam check.

Stops spam bots right away

• Hidden bot trap: an invisible field that only bots fill in.
• Real browser check: only accepts comments sent from a real web browser. Works with caching plugins.
• Too-fast check: people can’t type a comment in two seconds, so bots that do are blocked.
• Comment limit: stops one visitor from posting too many comments too quickly.
• Blocks pingbacks and trackbacks, which are mostly used by spammers.

Checks what comments say

Suspicious comments go to your Spam folder so you can double-check them:

• Smart detection: spots typical spam such as gambling and online casino promotions, links to free throwaway websites, comments that are just a link, known scam phrases, or one IP posting many comments. One sign alone is not enough, so honest comments are safe. Choose how strict it is: Relaxed, Normal (recommended) or Strict.
• Too many links, or a link in the Name field.
• Words or IP addresses you’ve blocked.
• Optional: comments written mostly in alphabets your visitors don’t use (for example Cyrillic or Chinese).

Optional: StopForumSpam check

• Turn on a check against StopForumSpam, a free list of known spammers shared by thousands of sites. Off by default.
• Only the IP address and a scrambled (hashed) copy of the email are sent. Answers are saved for a day.

Cleans up old comments

• Already have hundreds or thousands of spam comments? The clean-up tool checks the comments on your site and can move spam to Spam, move it to Trash, or delete it forever.
• Start with “Just show me” to see what it finds before changing anything.
• It works slowly in the background, a few comments at a time, so your site stays fast.
• A progress bar shows how far it has got and how much spam it found.
• It never touches comments from admins and moderators, logged-in members (unless you choose to check them), or WooCommerce order notes.

Easy to manage

Everything is in its own Anti Spam menu, written in plain words for site owners, not just developers.

• Overview: comments blocked today, this month and all time, the most common reasons in the last 30 days, and quick protection checks. A green dot means all good; a red dot comes with a one-line fix (for example, if your site uses Cloudflare but the plugin isn’t set up for it).
• Settings: simple on/off switches in five tabs (Stop bots, Spam detection, Known spammers, Clean-up, More). The safe choices are marked “Recommended” and already on.
• Clean Up: start, follow and stop a clean-up of old comments.
• Blocked Comments: see every blocked comment and exactly why it was blocked. Tick many at once to mark them Not spam, move them to Spam or Trash, or delete them. Block an IP address with one click.
• A dashboard box shows how much spam was blocked today, this month and overall.

Safe and private

• Comments sent through the WordPress REST API are checked too, not just the normal comment form.
• The list of blocked comments works with WordPress’s Export and Erase Personal Data tools, removes old entries automatically, and can hide part of each IP address.
• Nothing is ever sent to Kapatagan.

External services

This plugin can connect to StopForumSpam (https://www.stopforumspam.com/), a free database of known spammers. It is off by default and only used if the site owner turns on “Check commenters against StopForumSpam” in the settings.

• What it is used for: to check whether a commenter’s IP address or email address has been reported as a spammer.
• What is sent and when: when a comment is submitted (or when the site owner runs a clean-up of old comments), the commenter’s IP address and an MD5 hash of their email address are sent to https://api.stopforumspam.org/api. The email address itself, the name and the comment text are never sent. Answers are cached on the site for one day.
• Terms of use: https://www.stopforumspam.com/legal
• Privacy policy: https://www.stopforumspam.com/privacy

No other external services are used.

Security notes

• Every admin action checks capability and a nonce. All settings are sanitized against a whitelist; all output is escaped; all SQL is prepared.
• Visitors never learn which check blocked them.
• Proxy IP headers are ignored by default. Cloudflare’s header is only trusted when the request comes from a Cloudflare IP; X-Forwarded-For only when it comes from a private-network proxy.
• The token endpoint is POST-only, uncacheable and rate limited.
• The log stores truncated, tag-stripped text, is write-throttled per IP and capped at 10,000 rows, so a flood cannot fill the database.
• No external requests unless you turn on the StopForumSpam check. No file writes, no eval.
• Uninstall removes all options, transients and the log table.

Hooks

• kacs_comment_rejected (action) — $reason, $commentdata
• kacs_comment_spammed (action) — $reason, $comment_id
• kacs_enqueue_script (filter) — bool
• kacs_token_rate_limit (filter) — token requests per IP per 10 minutes (default 30)
• kacs_trusted_proxies (filter) — extra proxy IPs/CIDRs to trust
• kacs_cloudflare_ranges (filter) — Cloudflare IP ranges
• kacs_scan_time_budget (filter) — seconds per scanner run (default 8)
• kacs_free_hosts (filter) — list of free website hosts used as a spam sign
• kacs_disposable_email_domains / kacs_spammy_tlds (filters) — throwaway email services and spam-heavy web address endings
• kacs_gambling_brands / kacs_gambling_words (filters) — gambling names used as a spam sign
• kacs_spam_phrases (filter) — list of known spam phrases
• kacs_repeat_ip_count (filter) — comments from one IP before it counts as a spam sign (default 5)
• kacs_sfs_spam_confidence (filter) — StopForumSpam confidence (0-100) that marks a comment as spam on its own (default 80)
• kacs_sfs_seen_confidence (filter) — lower confidence that adds a spam sign (default 25)
• kacs_scan_max_load (filter) — skip scanner runs while the 1-minute load average is above this value (default 0 = off)