PHPackages                             ayesh/wordpress-comment-form-csrf - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. ayesh/wordpress-comment-form-csrf

ActiveWordpress-plugin[Security](/categories/security)

ayesh/wordpress-comment-form-csrf
=================================

Prevent Cross-Site Request Forgery attacks on your comments form.

v1.4(3y ago)09GPL-2.0-or-laterPHPPHP ^7.1

Since Feb 21Pushed 3y ago1 watchersCompare

[ Source](https://github.com/Ayesh/WordPress-Comment-Form-CSRF)[ Packagist](https://packagist.org/packages/ayesh/wordpress-comment-form-csrf)[ Docs](https://wordpress.org/plugins/comment-form-csrf-protection)[ RSS](/packages/ayesh-wordpress-comment-form-csrf/feed)WikiDiscussions master Synced 2w ago

READMEChangelogDependenciesVersions (4)Used By (0)

```
=== Comment Form CSRF Protection ===
Contributors: ayeshrajans
Tags: comments, spam, security, csrf
Requires at least: 4.2
Tested up to: 6.3
Stable tag: 1.4
Requires PHP: 7.1
License: GPLv2 or later

Prevent Cross-Site Request Forgery attacks on your comments form.

== Description ==
WordPress has a 12-year-old unfixed security vulnerability that it does not properly validate incoming comments.

An attacker can trick both anonymous and logged-in users to post comments on a victim site without them realizing, while using their own credentials.

See this issue for more information: https://core.trac.wordpress.org/ticket/10931

This is a tiny (fewer than 40 effect lines of code) module that adds a secure token to the comment form and validate it before accepting any comment, thus making your comment forms secure as they should\'ve been for all these years!

It provides no UI - just install it, and you are all set!

1. This plugin adds a secret cryptographically-secure token to the comment form. This is a unique value and is computationally impractical to guess it.
2. Upon comment submission, the comment is rejected if the secret tokens are not present or computationally invalid.

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/` directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. You are all set! There is nothing to configure. Your comment forms will contain the hidden token fields that will be properly validated upon submission.

== Changelog ==

= 1.0 =
* Initial release.

= 1.1 =
This is a minor release that contains minimal changes.

* Marks the plugin as tested up-to WordPress 5.3
* Fix in `composer.json` file that it required PHP^7.2 instead of intended ^7.1
* A micro optimization in the plugin to call the lambda function directly within the CSRF check.

= 1.4 =
Minor release that contains several typo fixes and WordPress 6.3 compatibility
```

###  Health Score

25

—

LowBetter than 35% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity4

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity58

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~806 days

Total

3

Last Release

1118d ago

PHP version history (2 changes)v1.0PHP ^7.2

v1.1PHP ^7.1

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/811553?v=4)[Ayesh Karunaratne](/maintainers/Ayesh)[@Ayesh](https://github.com/Ayesh)

---

Top Contributors

[![Ayesh](https://avatars.githubusercontent.com/u/811553?v=4)](https://github.com/Ayesh "Ayesh (14 commits)")

### Embed Badge

![Health badge](/badges/ayesh-wordpress-comment-form-csrf/health.svg)

```
[![Health](https://phpackages.com/badges/ayesh-wordpress-comment-form-csrf/health.svg)](https://phpackages.com/packages/ayesh-wordpress-comment-form-csrf)
```

###  Alternatives

[phpids/phpids

PHPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web application

791150.0k2](/packages/phpids-phpids)[paragonie/ecc

PHP Elliptic Curve Cryptography library

25866.3k44](/packages/paragonie-ecc)[nicobleiler/php-passphrase

Passphrase generator with Laravel integration, inspired by Bitwarden. Uses the EFF long word list by default with support for custom wordlists.

4912.6k](/packages/nicobleiler-php-passphrase)[dwgebler/encryption

Encryption wrapper for PHP using libsodium — simple API for symmetric and asymmetric encryption, password hashing, digital signing, and message authentication.

317.5k](/packages/dwgebler-encryption)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)