Kama SpamBlock for WordPress

Kama Spamblock blocks simple automated comment spam. It is invisible to normal visitors and does not use captchas.

The plugin protects the standard WordPress comment endpoint, wp-comments-post.php. It adds a small check to the comment form. Direct requests that skip the form are blocked.

This is a basic check, not proof that a person wrote the comment. Bots that load the page and run JavaScript can pass it. Kama Spamblock does not replace a full anti-spam service. It also checks pings and trackbacks for a link back to your site.

Even if you are using an external comment system like Disqus, Kama Spamblock can add lightweight protection. Automated requests can be posted directly to the ‘wp-comments-post.php’ file, where the plugin can block basic bots.

Simple and effective protection Kama Spamblock combines several small checks that are inexpensive for the site and invisible during normal commenting:

The protective field name and its unique code rotate together every four hours. Ten recent pairs remain valid for pages served from full-page cache.

Each marker is tied to the specific WordPress post, so a marker copied from another comment form is rejected.

The form must remain open for at least three seconds before it can be accepted.

Protective fields are added only after interaction with the comment submit button.

If a valid comment is blocked, a JavaScript-only retry form preserves the entered data.

The retry challenge changes its HTML structure to make basic scraping less reliable.

Pingbacks and trackbacks must return a successful HTTP response, non-binary content, and a real backlink.