Title: Kapatagan Anti Comment Spam Author: Jerico Vilog Published: November 13, 2026 Last modified: November 13, 2026 --- Search plugins ![](https://ps.w.org/kapatagan-anti-comment-spam/assets/banner-772x250.png?rev=3799531) ![](https://ps.w.org/kapatagan-anti-comment-spam/assets/icon.svg?rev=3799531) # Kapatagan Anti Comment Spam By [Jerico Vilog](https://profiles.wordpress.org/kapatagandev/) [Download](https://downloads.wordpress.org/plugin/kapatagan-anti-comment-spam.1.1.0.zip) * [Details](https://wordpress.org/plugins/kapatagan-anti-comment-spam/#description) * [Reviews](https://wordpress.org/plugins/kapatagan-anti-comment-spam/#reviews) * [Installation](https://wordpress.org/plugins/kapatagan-anti-comment-spam/#installation) * [Development](https://wordpress.org/plugins/kapatagan-anti-comment-spam/#developers) [Support](https://wordpress.org/support/plugin/kapatagan-anti-comment-spam/) ## Description Kapatagan Anti Comment Spam keeps spam out of your comments without annoying your visitors. There are no puzzles or “I am not a robot” boxes, and nothing is sent to outside services unless you turn on the optional StopForumSpam check. **Stops spam bots right away** * Hidden bot trap: an invisible field that only bots fill in. * Real browser check: only accepts comments sent from a real web browser. Works with caching plugins. * Too-fast check: people can’t type a comment in two seconds, so bots that do are blocked. * Comment limit: stops one visitor from posting too many comments too quickly. * Blocks pingbacks and trackbacks, which are mostly used by spammers. **Checks what comments say** Suspicious comments go to your Spam folder so you can double-check them: * Smart detection: spots typical spam such as gambling and online casino promotions, links to free throwaway websites, comments that are just a link, known scam phrases, or one IP posting many comments. One sign alone is not enough, so honest comments are safe. Choose how strict it is: Relaxed, Normal (recommended) or Strict. * Too many links, or a link in the Name field. * Words or IP addresses you’ve blocked. * Optional: comments written mostly in alphabets your visitors don’t use (for example Cyrillic or Chinese). **Optional: StopForumSpam check** * Turn on a check against StopForumSpam, a free list of known spammers shared by thousands of sites. Off by default. * Only the IP address and a scrambled (hashed) copy of the email are sent. Answers are saved for a day. **Cleans up old comments** * Already have hundreds or thousands of spam comments? The clean-up tool checks the comments on your site and can move spam to Spam, move it to Trash, or delete it forever. * Start with “Just show me” to see what it finds before changing anything. * It works slowly in the background, a few comments at a time, so your site stays fast. * A progress bar shows how far it has got and how much spam it found. * It never touches comments from admins and moderators, logged-in members (unless you choose to check them), or WooCommerce order notes. **Easy to manage** Everything is in its own **Anti Spam** menu, written in plain words for site owners, not just developers. * **Overview:** comments blocked today, this month and all time, the most common reasons in the last 30 days, and quick protection checks. A green dot means all good; a red dot comes with a one-line fix (for example, if your site uses Cloudflare but the plugin isn’t set up for it). * **Settings:** simple on/off switches in five tabs (Stop bots, Spam detection, Known spammers, Clean-up, More). The safe choices are marked “Recommended” and already on. * **Clean Up:** start, follow and stop a clean-up of old comments. * **Blocked Comments:** see every blocked comment and exactly why it was blocked. Tick many at once to mark them Not spam, move them to Spam or Trash, or delete them. Block an IP address with one click. * A dashboard box shows how much spam was blocked today, this month and overall. **Safe and private** * Comments sent through the WordPress REST API are checked too, not just the normal comment form. * The list of blocked comments works with WordPress’s Export and Erase Personal Data tools, removes old entries automatically, and can hide part of each IP address. * Nothing is ever sent to Kapatagan. ### External services This plugin can connect to **StopForumSpam** (https://www.stopforumspam.com/), a free database of known spammers. It is **off by default** and only used if the site owner turns on “Check commenters against StopForumSpam” in the settings. * What it is used for: to check whether a commenter’s IP address or email address has been reported as a spammer. * What is sent and when: when a comment is submitted (or when the site owner runs a clean-up of old comments), the commenter’s IP address and an MD5 hash of their email address are sent to https://api.stopforumspam.org/api. The email address itself, the name and the comment text are never sent. Answers are cached on the site for one day. * Terms of use: https://www.stopforumspam.com/legal * Privacy policy: https://www.stopforumspam.com/privacy No other external services are used. ### Security notes * Every admin action checks capability and a nonce. All settings are sanitized against a whitelist; all output is escaped; all SQL is prepared. * Visitors never learn which check blocked them. * Proxy IP headers are ignored by default. Cloudflare’s header is only trusted when the request comes from a Cloudflare IP; X-Forwarded-For only when it comes from a private-network proxy. * The token endpoint is POST-only, uncacheable and rate limited. * The log stores truncated, tag-stripped text, is write-throttled per IP and capped at 10,000 rows, so a flood cannot fill the database. * No external requests unless you turn on the StopForumSpam check. No file writes, no eval. * Uninstall removes all options, transients and the log table. ### Hooks * `kacs_comment_rejected` (action) — $reason, $commentdata * `kacs_comment_spammed` (action) — $reason, $comment_id * `kacs_enqueue_script` (filter) — bool * `kacs_token_rate_limit` (filter) — token requests per IP per 10 minutes (default 30) * `kacs_trusted_proxies` (filter) — extra proxy IPs/CIDRs to trust * `kacs_cloudflare_ranges` (filter) — Cloudflare IP ranges * `kacs_scan_time_budget` (filter) — seconds per scanner run (default 8) * `kacs_free_hosts` (filter) — list of free website hosts used as a spam sign * `kacs_disposable_email_domains` / `kacs_spammy_tlds` (filters) — throwaway email services and spam-heavy web address endings * `kacs_gambling_brands` / `kacs_gambling_words` (filters) — gambling names used as a spam sign * `kacs_spam_phrases` (filter) — list of known spam phrases * `kacs_repeat_ip_count` (filter) — comments from one IP before it counts as a spam sign (default 5) * `kacs_sfs_spam_confidence` (filter) — StopForumSpam confidence (0-100) that marks a comment as spam on its own (default 80) * `kacs_sfs_seen_confidence` (filter) — lower confidence that adds a spam sign ( default 25) * `kacs_scan_max_load` (filter) — skip scanner runs while the 1-minute load average is above this value (default 0 = off) ## Screenshots [⌊Overview: blocked today, this month and all time, the most common reasons, and protection checks.⌉⌊Overview: blocked today, this month and all time, the most common reasons, and protection checks.⌉[ Overview: blocked today, this month and all time, the most common reasons, and protection checks. [⌊Settings: simple on/off switches in tabs. Every option explains itself in one line.⌉⌊Settings: simple on/off switches in tabs. Every option explains itself in one line.⌉[ Settings: simple on/off switches in tabs. Every option explains itself in one line. [⌊Blocked Comments: every blocked comment, with the exact reason it was caught and one-click actions.⌉⌊Blocked Comments: every blocked comment, with the exact reason it was caught and one-click actions.⌉[ Blocked Comments: every blocked comment, with the exact reason it was caught and one-click actions. [⌊Clean Up: scan existing pending and approved comments, starting with "Just show me".⌉⌊Clean Up: scan existing pending and approved comments, starting with "Just show me".⌉[ Clean Up: scan existing pending and approved comments, starting with “Just show me”. [⌊Dashboard box: how much spam was blocked today, this month and overall.⌉⌊Dashboard box: how much spam was blocked today, this month and overall.⌉[ Dashboard box: how much spam was blocked today, this month and overall. ## Installation 1. Upload the plugin through Plugins Add New Upload Plugin, or copy the folder to`/ wp-content/plugins/`. 2. Activate it. Protection is on immediately with safe defaults. 3. Open Anti Spam Overview to see how your comment section is doing, and Anti Spam Settings to change anything. 4. To clean up old comments, choose “Just show me”, start a clean-up, check Anti Spam Blocked Comments, then switch to Move to Spam, Move to Trash or Delete forever. ## FAQ ### Is it really free? Yes. Every feature is free, with no subscriptions, no paid version and no ads in your dashboard. If it helps you, you can buy us a coffee at https://buymeacoffee. com/pinoygaming. It keeps the project going. ### Where can I get help? Email support@kapatagan.dev or visit https://kapatagan.dev/support/. Setup guides are at https://kapatagan.dev/docs/. ### My theme uses a custom comment form The plugin hooks into the standard `comment_form` action. If your theme builds its own form without it, the token is still added by JavaScript, but the honeypot is not. Use the `kacs_enqueue_script` filter to load the script on pages where `is_singular()` is false. ### Do visitors need JavaScript? Yes, while the JavaScript token is on. You can turn it off, but you’ll lose the strongest check. ### Does it work with caching plugins? Yes. Nothing secret is printed into the page; the token is fetched from admin-ajax. php, which is never cached. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Kapatagan Anti Comment Spam” is open source software. The following people have contributed to this plugin. Contributors * [ Jerico Vilog ](https://profiles.wordpress.org/kapatagandev/) [Translate “Kapatagan Anti Comment Spam” into your language.](https://translate.wordpress.org/projects/wp-plugins/kapatagan-anti-comment-spam) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/kapatagan-anti-comment-spam/), check out the [SVN repository](https://plugins.svn.wordpress.org/kapatagan-anti-comment-spam/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/kapatagan-anti-comment-spam/) by [RSS](https://plugins.trac.wordpress.org/log/kapatagan-anti-comment-spam/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.0 * New: Anti Spam has its own menu with an Overview screen: blocked counts, the most common reasons in the last 30 days, and protection checks (including a Cloudflare setup hint). * New look: settings are now split into tabs (Stop bots, Spam detection, Known spammers, Clean-up, More) with on/off switches, “Recommended” badges and a simple Relaxed / Normal / Strict picker. * Clean Up shows a clear progress bar and counts. Blocked Comments shows totals at the top. * Old Settings Kapatagan Anti Spam links redirect to the new screens. * Security: comments sent through the WordPress REST API are now checked too. Before, they skipped every check (WordPress only allows this for logged-in users unless another plugin turns on anonymous REST comments). * Fewer false alarms: a reader’s name or email that merely contains a gambling brand (like “Jilian” and “jili”) no longer counts as gambling, and links to court websites (“judiciary”) are no longer mistaken for the Indonesian gambling word“ judi”. * Fewer false alarms: readers with approved comments are no longer marked down for “same IP posted many comments”. * Clean-up now follows the same rule as new comments: comments by logged-in members are skipped unless “Also check logged-in members” is on. * StopForumSpam: if the service has a problem, new comments stop waiting on it for 15 minutes. * Privacy: Tools Export Personal Data and Erase Personal Data now include the Blocked Comments list. * Database queries tightened to pass the latest Plugin Check with no warnings. * Settings are kept. #### 1.0.0 * First public release on WordPress.org. * Includes everything from the 0.x test releases below: bot blocking, smart detection, the optional StopForumSpam check, the background clean-up and the Blocked Comments list. * Support link now points to https://kapatagan.dev/support/. #### 0.5.0 * New: optional StopForumSpam check (off by default). Known spammers (80%+ confidence) are sent to Spam; lower matches add points to smart detection. Only the IP address and a hashed email are sent; answers are cached for a day; the daily limit is respected; if the service is down, comments are checked by everything else. * The clean-up looks up many commenters in one request, so old comments are checked quickly. #### 0.4.3 * New: smart detection also checks the email and Website fields: throwaway email services, machine-made email addresses, names that do not match the email, website addresses popular with spammers, and spam or gambling names inside them. * New: “Block this email” and “Block this website” links in the Blocked Comments list. The list now shows each commenter’s website. #### 0.4.2 * New: a first-time commenter filling in the Website field now counts as a spam sign. * New: option “Treat a filled-in Website field from a first-time commenter as spam” for sites where real readers rarely add a website. #### 0.4.1 * New: smart detection spots gambling and online casino promotions (for example“ PH Sinwerte”, Jili, OKBet) in the name, email, website field or links. Words people write, like “casino heist”, are not affected. #### 0.4.0 * New: smart detection. Spots typical modern spam (gambling and online casino promotions, links to free throwaway websites, comments that are just a link, known spam phrases, one IP posting many comments, and more) using a points system, with Relaxed, Normal and Strict levels. * The Blocked Comments list shows the points and the signs that were found. #### 0.3.0 * New: bulk actions on the Blocked Comments list. Tick comments (or all of them) and choose Not spam, Move to Spam, Move to Trash, Delete forever, or Remove from this list. * New: “Apply to all comments found by the clean-up” handles the whole list, 200 at a time so your site stays fast. #### 0.2.5 * New: the Blocked Comments list explains each match, e.g. “3 links found, your limit is 2” or “Matched: casino”. * New: hidden links inside comment text are shown in the list as “text [link]”. * New: “Not spam” button. It restores the comment if needed and future clean-ups skip it. * Improved: a clean-up that was paused by a plugin update continues by itself. #### 0.2.4 * Fixed: links starting with “http://www.” were counted twice, so comments with only 2 links could be wrongly treated as spam. #### 0.2.3 * Coffee link now goes to our Buy Me a Coffee page. #### 0.2.2 * Added “Get help” and “Buy us a coffee” links. No pop-ups or reminders. #### 0.2.1 * Friendlier, plain-language labels and messages throughout. #### 0.2.0 * New: background comment scanner for pending/approved comments with test mode, spam, trash or permanent delete. * New: speed limit, time budget and lock for the scanner; deferred comment counting. * Hardening: honeypot input is unslashed and sanitized; regex matching no longer uses error suppression. #### 0.1.0 * Initial pre-release (0.x). Settings and behaviour may change before 1.0. ## Meta * Version **1.1.0** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[comments](https://wordpress.org/plugins/tags/comments/) [honeypot](https://wordpress.org/plugins/tags/honeypot/)[security](https://wordpress.org/plugins/tags/security/) [spam](https://wordpress.org/plugins/tags/spam/) * [Advanced View](https://wordpress.org/plugins/kapatagan-anti-comment-spam/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/kapatagan-anti-comment-spam/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/kapatagan-anti-comment-spam/reviews/) ## Contributors * [ Jerico Vilog ](https://profiles.wordpress.org/kapatagandev/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/kapatagan-anti-comment-spam/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://buymeacoffee.com/pinoygaming)