How we block malicious comments submitted by bots
On this page
Default Configuration – WordPress Comments
All sites hosted on Staq will now by default have Allow people to submit comments on new posts option disabled.
You can enable this anytime to accept comments by enabling by going into the WordPress dashboard > Settings > Discussions and then enabling this feature:

New default ban rule – WordPress Comments
Sites are then protected by the Staq Firewall based on our Rate Limiting feature.
The default ban rule watches for non-logged new comment post requests. If more than 1 comment was posted by the same IP address within the last 5 minutes then that IP address will be banned:
Comments real-time scanner
In addition to the firewall ban rule and default setting above, we now scan comment data right after a comment is submitted and before it is inserted into the database. In order to determine whether the comment is malicious or not, we check the following conditions:
- Comments with empty content are blocked.
- Comments with blacklisted (explicit) words in Author Name, Author URL, Author Email and comment’s content will be blocked.
- Using regular expressions, we scan for content that include hardcoded shortcodes inside comments. Those type of comments are blocked.
- Comments with Author Email that belong to domains that have no MX records will be blocked.
- If a comment is added to a post that is non-existent, a closed post, a trashed post, a draft post or a password-protected post, then, it will be blocked.
With machine learning, the system has the ability to learn the data and more cases will be added as we encounter different strategies used by bad actors to submit malicious comments.
Need some help?
We all do sometimes. Please reach out to our support team by dropping us a support ticket. We will respond fast.