WP Armour
89Fastest growing Anti Spam plugin. No API calls, subscriptions, captcha or puzzle. Full GDPR complaint. For com...
Free
400k+ installs 5★ (1,435)
Comment Form CSRF Protection
Prevent Cross-Site Request Forgery attacks on your comments form.
The facts
- Rating
- 5★ from 2
- Active installs
- 500+
- Price
- Free
- Last updated
- 23 Jul 2023
- Added
- Feb 2019
- Requires WP
- 4.2
- Tested up to
- WP 6.3.10
- Requires PHP
- 7.1
- Downloads
- 15,846
Our analysis
AI-assistedComment Form CSRF Protection is a WordPress plugin designed to enhance the security of comment forms by adding a secure token. This token is validated upon submission to prevent unauthorized comments from being posted, addressing a longstanding security vulnerability in WordPress.
The plugin is lightweight, requiring minimal installation effort as it operates without a user interface. It is suitable for WordPress site owners who want to improve comment security and protect against potential abuse.
Best for: WordPress site owners looking to secure their comment forms.
What it does well
- ✓Adds a secure token to comment forms
- ✓Validates tokens to prevent unauthorized comments
- ✓Lightweight with fewer than 40 lines of code
- ✓No user interface required for operation
- ✓Free to use from the WordPress.org directory
Where it falls short
- •Limited information available on additional features
- •No user interface may be a drawback for some users
Verdict
This plugin provides a straightforward solution for enhancing comment security, though its lack of features and user interface may limit its appeal to some users.
From the developer
Ayesh Karunaratne's own description of Comment Form CSRF Protection, lightly tidied.
WordPress has a 12-year-old unfixed security vulnerability that it does not properly validate incoming comments.
An attacker can trick both anonymous and logged-in users to post comments on a victim site without them realizing, while using their own credentials.
See this issue for more information: https://core.trac.wordpress.org/ticket/10931
This is a tiny (fewer than 40 effect lines of code) module that adds a secure token to the comment form and validate it before accepting any comment, thus making your comment forms secure as they should\’ve been for all these years!
It provides no UI – just install it, and you are all set!
- This plugin adds a secret cryptographically-secure token to the comment form. This is a unique value and is computationally impractical to guess it.
- Upon comment submission, the comment is rejected if the secret tokens are not present or computationally invalid.
Tagged as
industry
Crypto & Web3
quality
Security
Alternatives
Other plugins for comment systems.
Captcha Code
85GDPR compatible captcha anti-spam protection for login form, comments form, registration form & lost passw...
Free
100k+ installs 3.9★ (35)
Secure WordPress login, registration, and comment form with Google reCAPTCHA or Cloudflare Turnstile. Prevent...
Free
10k+ installs 4.9★ (20)
Comments
84Advanced AJAX-powered WordPress comments plugin with live commenting, comment voting, inline feedback, social...
Free
60k+ installs 4.7★ (578)
Intelligent spam protection for WordPress forms, comments, and reviews. No CAPTCHA needed. Works with WPForms,...
Free
7k+ installs 4.8★ (5)
Light and invisible protection against basic automated comment spam. Pings and trackbacks check for real backl...
Free
4k+ installs 5★ (17)