Comment Form CSRF Protection vs Comments by FastComments – Live, Privacy-First Comment System

WordPress has a 12-year-old unfixed security vulnerability that it does not properly validate incoming comments. An attacker can trick both anonymous and logged-in users to post comments on a victim site without them realizing, while using their own credentials. See this issue for more information: https://core.trac.wordpress.org/ticket/10931 This is a tiny (fewer than 40 effect lines of code) module that adds a secure token to the comment form and validate it before accepting any comment, thus making your comment forms secure as they should\’ve been for all these years! It provides no UI – just install it, and you are all set! This plugin adds a secret cryptographically-secure token to the comment form. This is a unique value and is computationally impractical to guess it. Upon comment submission, the comment is rejected if the secret tokens are not present or computationally invalid.

FastComments is the fast, privacy-first commenting system trusted by 4,100+ organizations serving over 541 million page loads per year. Drop-in replacement for WordPress default comments, Disqus, Jetpack Comments, and wpDiscuz — with zero ads, zero data harvesting, and load times measured in milliseconds. Why Site Owners Switch to FastComments No Ads, Ever — Unlike Disqus, FastComments never injects sponsored content or ads into your comment threads. No Data Harvesting — Your visitors’ data is never sold to third parties. Full GDPR compliance with optional EU data residency. Blazing Fast — Comments load in milliseconds. Users report significant reductions in page weight and fewer dependencies vs. other comment systems. Comments Stay In Sync — FastComments keeps your WordPress comment database in sync. Cancel anytime and your comments stay intact. Migrate In Minutes — One-click import from Disqus, Hyvor, WordPress native comments, and more. Avatars and images migrate automatically. Live, Real-Time Commenting Comments appear instantly for all viewers — no page refresh needed Live moderation: approve, delete, and edit comments in real time Real-time reply notifications keep discussions active Streaming Chat mode for live events and AMAs Powerful Moderation & Spam Prevention Automated spam detection blocks bot submissions before they appear Unverified/anonymous comments auto-removed after configurable period Full moderation dashboard with search, filter, and bulk actions Comment flagging and user blocking Built for Engagement Threaded reply-to-reply conversations with unlimited nesting depth Upvoting and downvoting with smart duplicate prevention Image and GIF attachments in comments Full-text comment search for readers @mentions and reply notifications Commenter ranking system Developer & Site Admin Friendly Single Sign-On (SSO) for seamless authentication with your existing users Works without JavaScript — accessible commenting for all visitors Full REST API and webhook support Custom CSS and JavaScript injection for complete design control LearnDash LMS compatibility Block-based theme support (FSE) Password-protected post support Localization Fully localized with automatic browser locale detection. Currently available in English, French, and Spanish. Community translations welcome. Trusted By Many 4,100+ organizations 1,775,632+ registered users 541 million+ page loads served in the past year 5-star rating on WordPress.org Pricing FastComments offers flexible, traffic-based pricing starting well under $5/month for most sites. No per-comment charges. No surprise fees. See full pricing at fastcomments.com/traffic-pricing. Support Responsive, hands-on support from the development team. Migration assistance included. Most issues resolved within hours.