Forget Spam Comment
The fastest and GDPR compliant Anti-Spam plugin to prevent bot spam in the Default Commenting System of WordPress. Important Please clear page cache after plugin activation. Only for default commenting system. Not for AMP. Features 100% GDPR Compliant. Captcha-Free solution. Requires no settings. Automatic. No need of false-positive comment moderation. Compatible with all page caching and performance optimization plugins. Fastest ever. A tiny inline JavaScript in just ~200 bytes does all magic. How does it work? To prevent spam comments plugin blocks the default action path (wp-comments-post.php) for bots and make it accessible over unique hash query string when a visitor scroll to leave a comment. This way it prevents automated spam comment done by bots. Video Demonstration Watch on YouTube Let’s support each other 🙏 Please Upvote Forget Spam Comment plugin at Product Hunt You can contact me to report any issues. I’d be happy to assist.
Strict CSP
This plugin enforces a Strict Content Security Policy (CSP) on the frontend and login screen. This helps mitigate cross-site scripting (XSS) vulnerabilities. The policy cannot yet be applied to the WP Admin (see #59446). In #58664, the manual construction of script tags was eliminated from WP_Scripts and inline scripts on frontend/login screen, thanks to the helper functions which had previously been introduced in #39941. This made it possible to apply Strict CSP, as long as themes and plugins are not directly printing tags. Some bundled WordPress core themes still do this incorrectly (which has been reported in Trac as #63806). For example, do not do this: function my_theme_supports_js() { echo ' document.body.classList.remove("no-js"); '; // ❌ } add_action( 'wp_footer', 'my_theme_supports_js' ); Instead, do this: function my_theme_supports_js() { wp_print_inline_script_tag( 'document.body.classList.remove("no-js");' ); // ✅ } add_action( 'wp_footer', 'my_theme_supports_js' ); So in order for scripts to execute, they must be printed using the relevant APIs in WordPress for adding scripts, including wp_enqueue_script(), wp_add_inline_script(), wp_localize_script(), wp_print_script_tag(), wp_print_inline_script_tag(), and wp_enqueue_script_module(). Otherwise, a script’s execution will be blocked and an error will appear in the console, for example: Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘nonce-9b539cfe47’ ‘unsafe-inline’ ‘strict-dynamic’ https: http:”. Note that ‘unsafe-inline’ is ignored if either a hash or nonce value is present in the source list. This also blocks scripts inside of event handler attributes, such as onclick, onchange, onsubmit, and onload. As noted on MDN: Warning: The use of event handler content attributes is discouraged. The mix of HTML and JavaScript often produces unmaintainable code, and the execution of event handler attributes may also be blocked by content security policies. This plugin also ensures that scripts added to the page from embeds (e.g. Tweets) also get the nonce attribute added.
