Getting Started

Deployment Deployment - Diagnose Migrations Staging

Site Management

Backups Client Reporting Passwords Plugin Automation Plugin Management - Global Plugins & Themes - Diagnose Plugins & Themes - General Plugins & Themes - Git Plugins & Themes - Logs Must Install White Label WordPress Updates

Caching & Performance

Caching Caching - Blogs/Articles Caching - Diagnose Caching - Git Caching - WooCommerce Redis Optimize & Scale

Security

Security Security - Firewall

SMTP, CDN & DNS

SMTP SendGrid CDN CDN - AWS CDN - Cloudflare CDN - Diagnose Domains & DNS

Server & Tools

Analytics & Logs CRON Jobs Database Debug Tool Git Monitoring PHP Settings Redirects SEO Tools Server Errors sFTP SSL

Staq Billing

Staq Billing > Account Staq Billing > Client Staq Billing > Setup

Media

Media Media - Diagnose Media - Optimize

Accounts & Billing

Accounts & Billing

General

WordPress Hosting Website Diagnose Troubleshoot - Other

How we block malicious comments submitted by bots


On this page

    Default Configuration – WordPress Comments

    All sites hosted on Staq will now by default have Allow people to submit comments on new posts option disabled.
    You can enable this anytime to accept comments by enabling by going into the WordPress dashboard > Settings > Discussions and then enabling this feature:

    New default ban rule – WordPress Comments

    Sites are then protected by the Staq Firewall based on our Rate Limiting feature.
    The default ban rule watches for non-logged new comment post requests. If more than 1 comment was posted by the same IP address within the last 5 minutes then that IP address will be banned:
     
    image.png

    Comments real-time scanner

    In addition to the firewall ban rule and default setting above, we now scan comment data right after a comment is submitted and before it is inserted into the database. In order to determine whether the comment is malicious or not, we check the following conditions:
    1. Comments with empty content are blocked.
    2. Comments with blacklisted (explicit) words in Author Name, Author URL, Author Email and comment’s content will be blocked.
    3. Using regular expressions, we scan for content that include hardcoded shortcodes inside comments. Those type of comments are blocked.
    4. Comments with Author Email that belong to domains that have no MX records will be blocked.
    5. If a comment is added to a post that is non-existent, a closed post, a trashed post, a draft post or a password-protected post, then, it will be blocked.

    With machine learning, the system has the ability to learn the data and more cases will be added as we encounter different strategies used by bad actors to submit malicious comments.

    Need some help?

    We all do sometimes. Please reach out to our support team by dropping us a support ticket. We will respond fast.