WordPress comment system for managing user discussions on posts and pages.

Since: 1.0.0
Source: wp-includes/comment.php, wp-includes/class-wp-comment.php, wp-includes/class-wp-comment-query.php, wp-includes/comment-template.php

Components

Comment System Overview

WordPress comments enable threaded discussions on posts and pages. The system supports:

• Regular comments – User-submitted responses to content
• Pingbacks – Automatic notifications when another blog links to your post
• Trackbacks – Manual notifications between blogs
• Notes – Internal comments (since 6.9.0) excluded from public counts

Database Schema

Comments are stored in the wp_comments table:

Comment metadata is stored in wp_commentmeta.

Comment Statuses

Comment Types

Threading Model

Comments support hierarchical threading:

Comment (parent = 0)
├── Reply (parent = Comment ID)
│   └── Reply to reply (parent = Reply ID)
└── Another reply (parent = Comment ID)

Threading is controlled by:

• thread_comments option – Enable/disable threading
• thread_comments_depth option – Maximum nesting depth (default 5)

Comment Flow

Submission Flow

User submits form
    └── wp-comments-post.php
        └── wp_new_comment()
            ├── preprocess_comment filter
            ├── wp_allow_comment() - duplicate/flood checks
            ├── wp_filter_comment() - sanitization
            ├── wp_check_comment_data() - approval decision
            ├── wp_insert_comment() - database insert
            └── comment_post action

Approval Decision

wp_allow_comment()
    ├── Check for duplicates
    ├── Check for flooding
    └── wp_check_comment_data()
        ├── check_comment() - moderation keywords, links
        ├── wp_check_comment_disallowed_list() - blocklist
        └── pre_comment_approved filter

Moderation System

Automatic Moderation

Comments are held for moderation when:

• comment_moderation option is enabled (all comments moderated)
• Comment contains more links than comment_max_links allows
• Comment matches words in moderation_keys option
• Author has no previously approved comments (if comment_previously_approved enabled)

Blocklist/Disallowed Words

Comments matching disallowed_keys are automatically marked as:

• spam if EMPTY_TRASH_DAYS is 0
• trash if trash is enabled

Caching

Comments use WordPress object cache:

Comment Pagination

Pagination is controlled by:

• page_comments option – Enable pagination
• comments_per_page option – Comments per page
• default_comments_page option – Show newest or oldest first
• cpage query var – Current comment page

Security Considerations

Validation

• Author name: 245 characters max
• Email: 100 characters max
• URL: 200 characters max
• Content: 65525 characters max

Sanitization

• All fields filtered via pre_comment_* filters
• Content filtered via pre_comment_content
• HTML filtered based on user capabilities (unfiltered_html)

Flood Protection

• wp_check_comment_flood() prevents rapid submissions
• Configurable via comment_flood_filter filter
• Admins/moderators bypass flood checks

Cookie Handling

Commenter info stored in cookies:

• comment_author_{COOKIEHASH}
• comment_author_email_{COOKIEHASH}
• comment_author_url_{COOKIEHASH}

Consent tracked via wp-comment-cookies-consent checkbox when show_comments_cookies_opt_in is enabled.

Related Options