Title: Xenon Comment Review Agent Author: xenon2233 Published: August 12, 2026 Last modified: August 12, 2026 --- Search plugins ![](https://ps.w.org/xenon-comment-review-agent/assets/icon.svg?rev=3642910) # Xenon Comment Review Agent By [xenon2233](https://profiles.wordpress.org/xenon2233/) [Download](https://downloads.wordpress.org/plugin/xenon-comment-review-agent.1.2.3.zip) * [Details](https://wordpress.org/plugins/xenon-comment-review-agent/#description) * [Reviews](https://wordpress.org/plugins/xenon-comment-review-agent/#reviews) * [Installation](https://wordpress.org/plugins/xenon-comment-review-agent/#installation) * [Development](https://wordpress.org/plugins/xenon-comment-review-agent/#developers) [Support](https://wordpress.org/support/plugin/xenon-comment-review-agent/) ## Description Xenon Comment Review Agent uses AI Agent technology to automatically review and moderate comments on your WordPress site. The AI analyzes each comment in context and autonomously decides whether to approve, reject, or flag it for human review. **Key Features:** * 🤖 **AI Agent Mode** — AI uses function calling (tool use) to autonomously make moderation decisions * ⚡ **Async Queue Processing** — Comments are moderated in the background via WP-Cron, zero impact on page load * 🔌 **Extensible AI Providers** — OpenAI built-in, architecture supports adding Gemini, DeepSeek, and more * 📊 **Statistics Dashboard** — Track approval, rejection, and flag rates at a glance * 📝 **Audit Log** — Detailed logging of every moderation decision with reason, model, and token usage * 🌐 **Multi-Language UI** — Chinese and English interface, easily extensible to more languages * ⚙️ **Customizable System Prompt** — Full control over how the AI evaluates comments * 🛡️ **Prompt Injection Protection** — Visitor data is isolated inside a fence carrying a per-request random token, so a comment cannot impersonate an instruction. Built-in detection patterns can be extended with your own, and a detected comment can be held for human review instead of being auto-approved * 🧹 **Smart Rules** — Skip admin comments, configurable queue interval, auto-cleanup old records **How It Works:** 1. A visitor submits a comment 2. The comment enters the moderation queue, which schedules a review straight away 3. The AI Agent reviews the comment, usually within seconds of submission; a recurring sweep picks up anything the immediate run missed 4. The AI analyzes context (comment content, article title, author info) and decides: 5. * ✅ **Approve** — Genuine, relevant comment Published * 🚫 **Reject** — Spam, hate speech, or harmful Trash * ⚠️ **Flag** — Uncertain, needs human review Stays pending **Supported AI Providers:** * OpenAI (GPT-4o Mini, GPT-4o, GPT-4, etc.) * Any OpenAI-compatible API (via custom Base URL) ### External Services This plugin connects to third-party AI API services to perform comment moderation analysis. #### OpenAI API This plugin sends comment data to the OpenAI API (or a compatible API endpoint configured by the user) for AI-powered moderation analysis. **What data is sent:** * Comment content (text) * Comment author name, email, and IP address * Post title, and the first 100 words of the post content (for context)* Parent comment content, when the comment is a reply and the parent is already published Each field is truncated before it is sent: 4000 characters for the comment, 1500 for the post extract, 1000 for the parent comment, and 200 for each of the author fields. **When data is sent:** * Data is sent when the WP-Cron queue processor runs to moderate pending comments * Data is also sent when an administrator manually triggers queue processing or tests the API connection **Service details:** * Default API endpoint: https://api.openai.com/v1 * Users can configure a custom API Base URL to use alternative OpenAI-compatible services* OpenAI Terms of Use: https://openai.com/terms/ * OpenAI Privacy Policy: https:// openai.com/privacy/ ### Development The source code for the compiled JavaScript files in the `build/` directory can be found in the `src/` directory of this plugin, or on GitHub: https://github.com/ Xenon-XG/Xenon-Comment-Review-Agent To build from source: 1. Run `npm install` 2. Run `npm run build` ## Screenshots [⌊Settings page — Configure AI provider, API key, and system prompt⌉⌊Settings page— Configure AI provider, API key, and system prompt⌉[ Settings page — Configure AI provider, API key, and system prompt [⌊Queue management — Review the moderation queue with each decision and its reason⌉⌊ Queue management — Review the moderation queue with each decision and its reason⌉[ Queue management — Review the moderation queue with each decision and its reason [⌊Statistics dashboard — Track approval, rejection, and flag rates at a glance⌉⌊ Statistics dashboard — Track approval, rejection, and flag rates at a glance⌉[ Statistics dashboard — Track approval, rejection, and flag rates at a glance ## Installation 1. Upload the `xenon-comment-review-agent` folder to the `/wp-content/plugins/` directory 2. Activate the plugin through the ‘Plugins’ menu in WordPress 3. Go to **Comments AI Moderation** to configure your AI provider and API key 4. Go to **Settings Discussion** and enable “Comment must be manually approved” 5. Enable AI moderation in the plugin settings ## FAQ ### Which AI providers are supported? Currently OpenAI (GPT-4o Mini, GPT-4o, etc.) and any OpenAI-compatible API. The plugin architecture supports adding more providers like Google Gemini and DeepSeek. ### Does it work with custom API endpoints? Yes. You can set a custom API Base URL to use proxies or any OpenAI-compatible API service. ### Will it slow down my site? No. Moderation is handled asynchronously via WP-Cron in the background, so visitors won’t experience any delay. ### Can I customize the moderation rules? Yes. You can fully customize the AI system prompt to define your own moderation criteria and behavior. ### What happens if the AI is unsure? When the AI is uncertain about a comment, it flags the comment for human review rather than making a wrong decision. The comment stays in pending status for you to review manually. ### Is my data sent to third parties? Yes — to the AI provider you configure, and only there. To judge a comment the plugin sends the comment text, the author’s name, email address and IP address, the post title, the first 100 words of the post, and the parent comment when the comment is a reply. Nothing is sent anywhere else, and nothing is sent at all until you supply an API key and enable moderation. The “External Services” section below describes this in full. ### Can I see why a comment was approved or rejected? Yes. The Audit Log records every decision with the AI’s reasoning, the model used, and token consumption. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Xenon Comment Review Agent” is open source software. The following people have contributed to this plugin. Contributors * [ xenon2233 ](https://profiles.wordpress.org/xenon2233/) [Translate “Xenon Comment Review Agent” into your language.](https://translate.wordpress.org/projects/wp-plugins/xenon-comment-review-agent) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/xenon-comment-review-agent/), check out the [SVN repository](https://plugins.svn.wordpress.org/xenon-comment-review-agent/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/xenon-comment-review-agent/) by [RSS](https://plugins.trac.wordpress.org/log/xenon-comment-review-agent/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.3 * Reworded the screenshot captions. No change to plugin behaviour. #### 1.2.2 * Move the multisite uninstall loop into a function, so it no longer leaves variables in the global namespace * Use the same annotation form as the rest of the file for the audit log insert #### 1.2.1 Hardening and correctness pass over 1.2.0. Moderation timing: * Moderate a new comment immediately instead of waiting for the next scheduled sweep. WP-Cron only runs when a page is loaded, so a comment previously waited for both the next visitor and the configured interval; it is now usually reviewed within seconds * Only schedule the recurring sweep while moderation is enabled, and raise its default interval to 5 minutes now that it is a fallback rather than the primary trigger Injection protection: * Normalise zero-width, bidi and full-width characters before matching, so a single invisible codepoint no longer slips a payload past every detection pattern * Also scan the post title, post extract and author IP, which reach the model but were previously excluded from detection * Derive the fence token from random_bytes() rather than wp_generate_password(), whose public filter let another plugin make the token predictable * Prefer flagging over rejecting when a signal could be innocent, so an ordinary bug report beginning “System: Windows 11” is held for a human rather than trashed * Record detections even when the AI request itself fails * Put a flagged comment on hold explicitly rather than assuming it already is Fixes: * Fix “Moderate approved comments” doing nothing. Comments WordPress had already approved were closed as “already moderated” before the AI ever saw them, which is exactly the case that setting exists to cover * Fix settings silently reverting. The settings screen re-seeded itself from the values present at page load, so switching tabs and saving again could overwrite what had just been stored * Fix custom detection patterns containing “<” being stripped on save * Fix new settings never reaching an existing installation, which left injection blocking off while the settings screen showed it on * Fix the connection test sending the stored API key to a caller-supplied endpoint * Fix a fatal error when the queue or log endpoints were given a non-integer page size * Fix a transient provider failure consuming all three retries within one sweep * Fix a spam verdict from another plugin being overturned on retry * Fix the “comment re-queued” notice never appearing * Fix the cleanup cutoff comparing UTC against site-local timestamps * Fix the cleanup event being left scheduled after deactivation * Record the database version only once the schema is verifiably in place Housekeeping: * Restrict admin notices to the screens where they can be acted on * Remove all plugin data from every site of a multisite network on uninstall, including the stored API key * Use English as the source language for all translatable strings, so the plugin can be translated on translate.wordpress.org * Require WordPress 6.6 or later, matching the react-jsx-runtime script dependency the admin interface is built against * Correct the readme description of what is sent to the AI provider #### 1.2.0 * Add prompt injection protection. Visitor-supplied data (comment body, author name and email, article context, parent comment) is now isolated inside a fence whose delimiter carries a per-request random token, so comment text cannot be read as an instruction to the moderating model * Add configurable injection detection. Built-in patterns cover tool-name references, instruction overrides, role spoofing, delimiter forgery and false authority claims; site owners can add their own plain-text patterns in the settings page * Add a setting controlling whether a detection blocks auto-approval. Detection always runs and is always recorded; enforcement is optional * Add an audit log filter and badge for injection detections. Detections are recorded even when routine audit logging is disabled * Only include a parent comment in the AI context when it has been approved, closing a channel where an unapproved comment could still reach the prompt * Fix the default system prompt never being used. It is stored as an empty string, so the null-coalescing fallback never triggered and the model received no moderation rules * Fix a race in the moderation queue. Items are now claimed atomically, so concurrent cron runs cannot moderate the same comment twice * Fix queue items becoming permanently stuck. Items abandoned by a worker that died mid-request are now returned to the queue or marked as errors * Fix the admin UI language not following the stored setting on first load * Fix CREATE TABLE statements so dbDelta can perform schema upgrades. The previous statements used IF NOT EXISTS, which made dbDelta parse the table name incorrectly and silently skip every schema comparison * Add an injection column to the audit log table (database version 1.1.0) * Cap the length of every field sent to the AI provider and of the returned reason #### 1.1.3 * Fix Contributors username to match WordPress.org profile * Add External Services section declaring OpenAI API usage * Add Development section with source code link and build instructions * Rename JS global variable to use plugin-specific prefix (xcraData) * Rename WP-Cron schedule to use plugin-specific prefix (xcra_every_) #### 1.0.0 * Initial release * OpenAI provider with function calling (AI Agent mode) * Async moderation queue with configurable WP-Cron interval * React SPA settings page with multi-language support (Chinese / English) * Queue management with retry and delete * Audit log with detail view and bulk clear * Statistics dashboard * Comment list AI status column * Re-moderation action * Clean uninstall (removes all plugin data) ## Meta * Version **1.2.3** * Last updated **11 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.6 or higher ** * Tested up to **7.0.4** * PHP version ** 7.4 or higher ** * Tags * [AI](https://wordpress.org/plugins/tags/ai/)[comments](https://wordpress.org/plugins/tags/comments/) [moderation](https://wordpress.org/plugins/tags/moderation/)[openai](https://wordpress.org/plugins/tags/openai/) [spam](https://wordpress.org/plugins/tags/spam/) * [Advanced View](https://wordpress.org/plugins/xenon-comment-review-agent/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/xenon-comment-review-agent/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/xenon-comment-review-agent/reviews/) ## Contributors * [ xenon2233 ](https://profiles.wordpress.org/xenon2233/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/xenon-comment-review-agent/)