manifest / security / commentsecurityplugin

Comment Security Analyzer

A WordPress plugin that analyzes post comments and marks malicious comments as spam.

by bryangalligroup · github.com/bryangalligroup/commentsecurityplugin

★ 0stars

0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/bryangalligroup/commentsecurityplugin/archive/refs/heads/main.zip

Readme

Comment Security Analyzer

A WordPress plugin designed to automatically analyze comments and identify potential spam, suspicious links, duplicate comments, malicious patterns, and automated behavior.

The plugin uses a risk scoring system to determine whether a comment should follow the normal WordPress workflow, be sent for moderation, or be marked as spam.

Features

Link Analysis

The plugin detects links contained in comments, including:

http://
https://
www.example.com

The following factors increase the risk score:

Comment contains a link;
Comment contains multiple links;
Short comment containing a link;
Invalid URLs;
URLs using an IP address directly;
Unsafe or unsupported URL schemes.

For security reasons, the plugin does not automatically access links submitted by users.

This prevents the WordPress server from making requests to potentially malicious URLs or internal resources.

Risk Scoring System

Each comment receives a score based on the signals detected during the analysis.

Score	Action
0–39	Normal WordPress workflow
40–69	Sent to moderation
70+	Marked as spam

These thresholds can be configured through the WordPress administration panel.

Example:

Comment:

"Great article! Visit https://example.com"

Analysis:

+30 contains_link
+20 short_comment_with_link
+20 foreign_language

Total score: 70

Status: spam

Implemented Features

V1 — Basic Analysis

Link detection;
Multiple link detection;
Short comments containing links;
Invalid URLs;
URLs containing IP addresses;
Suspicious keywords;
Excessively repeated characters;
Unusual character sequences;
Risk scoring system;
Automatic classification as normal, moderation, or spam.

V2 — Persistence and Administration

After a comment is created, the analysis result is stored as WordPress comment metadata.

The following metadata is stored:

_csa_score
_csa_reasons
_csa_analyzed_at

Example:

{
  "score": 75,
  "reasons": [
    {
      "code": "contains_link",
      "points": 30
    },
    {
      "code": "short_comment_with_link",
      "points": 20
    },
    {
      "code": "spam_keyword",
      "points": 15,
      "context": {
        "keyword": "casino"
      }
    }
  ]
}

A new column called:

CSA Risk

is also added to the WordPress comments administration screen.

V3 — Advanced Analysis

Language Detection

The plugin includes an initial language detection implementation based on heuristics and common words.

Currently supported languages:

Portuguese (pt);
English (en);
Spanish (es);
French (fr);
German (de).

Language detection is intentionally conservative.

Language is not used as the only criterion for classifying a comment as spam. If a non-allowed language is detected with sufficient confidence, additional points are added to the risk score.

Duplicate Comment Detection

The plugin checks whether the same comment content already exists among active comments.

Example:

Comment 1:

Excellent article! Check my website.

Comment 2:

Excellent article! Check my website.

The second comment receives the reason:

duplicate_comment

and additional points are added to its risk score.

IP-Based Rate Limiting

The plugin monitors how many comments are submitted from the same IP address within a configurable time window.

Example:

Maximum comments: 5

Time window: 600 seconds

If the limit is exceeded:

rate_limit_exceeded

is added to the analysis result.

The IP address is hashed using SHA-256 before being used as a cache key.

Installation

Method 1 — Upload Through WordPress

Open the WordPress administration panel;
Navigate to:

Plugins
→ Add New
→ Upload Plugin

Select:

comment-security-analyzer-v0.3.0.zip

Install the plugin;
Activate it.

Method 2 — Manual Installation

Extract the plugin into:

wp-content/plugins/

The final structure should look like:

wp-content/
└── plugins/
    └── comment-security-analyzer/
        ├── comment-security-analyzer.php
        ├── uninstall.php
        │
        ├── includes/
        │   ├── class-csa-plugin.php
        │   ├── class-csa-settings.php
        │   ├── class-csa-analysis-result.php
        │   ├── class-csa-link-analyzer.php
        │   ├── class-csa-pattern-analyzer.php
        │   ├── class-csa-language-analyzer.php
        │   ├── class-csa-duplicate-analyzer.php
        │   ├── class-csa-rate-limit-analyzer.php
        │   ├── class-csa-comment-analyzer.php
        │   └── class-csa-moderator.php
        │
        └── admin/
            └── class-csa-admin.php

After installation, activate the plugin from:

Plugins

Configuration

After activating the plugin, navigate to:

Settings
→ Comment Security

The following options are available.

Moderation Score

Defines the minimum score required for a comment to be sent to moderation.

Default value:

Spam Score

Defines the minimum score required for a comment to be automatically marked as spam.

Default value:

Language Detection

Enables or disables language analysis.

Allowed languages can be configured individually.

Non-Allowed Language Score

Defines how many points are added when a non-allowed language is detected.

Default value:

Duplicate Comment Score

Defines how many points are added when a duplicate comment is detected.

Default value:

Rate Limiting

Allows configuration of:

Maximum number of comments;
Time window;
Score added when the limit is exceeded.

Example:

Maximum: 5 comments

Window: 600 seconds

Score: 25

Keywords

Keywords are configured with one expression per line.

Example:

casino
viagra
cialis
crypto investment
seo service
backlinks
guest post
online pharmacy

Each detected keyword adds points to the risk score.

Architecture

The main plugin flow works as follows:

New Comment
       │
       ▼
pre_comment_approved
       │
       ▼
CSA_Comment_Analyzer
       │
       ├── Link Analyzer
       │
       ├── Pattern Analyzer
       │
       ├── Language Analyzer
       │
       ├── Duplicate Analyzer
       │
       └── Rate Limit Analyzer
               │
               ▼
          Analysis Result
               │
               ▼
            Risk Score
               │
       ┌───────┼────────┐
       │       │        │
       ▼       ▼        ▼
     Normal  Moderate   Spam
               │
               ▼
          comment_post
               │
               ▼
        Store Analysis Data

Project Structure

comment-security-analyzer/
│
├── comment-security-analyzer.php
├── uninstall.php
│
├── includes/
│   ├── class-csa-plugin.php
│   ├── class-csa-settings.php
│   ├── class-csa-analysis-result.php
│   ├── class-csa-link-analyzer.php
│   ├── class-csa-pattern-analyzer.php
│   ├── class-csa-language-analyzer.php
│   ├── class-csa-duplicate-analyzer.php
│   ├── class-csa-rate-limit-analyzer.php
│   ├── class-csa-comment-analyzer.php
│   └── class-csa-moderator.php
│
└── admin/
    └── class-csa-admin.php

Security Considerations

External Links

The plugin does not access URLs contained in comments.

This is important to reduce the risk of vulnerabilities such as:

Server-Side Request Forgery (SSRF);
Access to internal services;
Access to localhost;
Access to private networks;
Access to cloud metadata services;
Malicious redirects;
Excessive resource consumption.

The current implementation performs structural analysis only.

Rate Limiting

The current implementation uses the IP address available in the WordPress comment flow.

In environments using:

Cloudflare;
Reverse proxies;
Nginx;
Traefik;
Load balancers;

the real client IP must be configured correctly.

It is not recommended to blindly trust headers such as:

X-Forwarded-For

unless the request is known to originate from a trusted proxy.

Language Detection

The current implementation should not be considered a definitive language detection system.

It uses heuristics and common words and may produce:

False positives;
False negatives;
Low accuracy for short comments;
Difficulty detecting multilingual comments.

For this reason, language detection only contributes to the risk score and should not be used alone to automatically delete or block comments.

Requirements

WordPress 6.0 or higher;
PHP 8.1 or higher.

Read the full README on GitHub →