Comment moderation: tools, rules and workflows
Comment moderation works 3 ways: before publishing, after, or when reported. CommentCamp, $0 for site owners, filters spam and has a moderation queue. WordPress holds any comment with 2+ links by default, and most sites add keyword filters, trust levels and classifiers such as OpenAI's free API, which flags 13 harm categories.
- WordPress link hold
- 2+ links held by default
- OpenAI moderation API
- Free, 13 categories
- Perspective API
- Active until Dec 31, 2026
- Azure free tier
- 5,000 text records/month
Pre-moderation, post-moderation or reactive?
There are three basic ways to run a comment section, and most sites mix them.
- Pre-moderation: every comment waits in a queue until you approve it. Nothing harmful goes live, but conversations slow down.
- Post-moderation: comments publish right away and you review them afterward. Discussion flows, and you clean up after the fact.
- Reactive moderation: comments go live and you only step in when a reader reports one. It's the least work and the most risk.
The choice affects who sticks around. In a 2016 Center for Media Engagement survey, argumentative comments were a reason to stay away for 33.9% of commenters and 40.9% of comment readers.
| Approach | Effort | Risk | When to use |
|---|---|---|---|
| Pre-moderation | High | Lowest | Sensitive topics, small sites or launch weeks |
| Post-moderation | Medium | Medium | Active blogs where someone checks in during the day |
| Reactive (report-based) | Low until flagged | High | Small, high-trust communities with a visible report button |
| Keyword hold lists | Low setup, ongoing tweaks | Medium | Known slurs, spam phrases and competitor links |
| Trust levels or first-comment approval | Low | Low to medium | Letting regulars talk freely while screening newcomers |
| Automated classifiers | Technical setup, low daily work | Low to medium | High-volume sites that need a first pass before a human |
CommentCamp: spam filtering and a queue built in
CommentCamp is a free comment system we're building for independent publishers, bloggers and WordPress sites. Automated spam filtering and a moderation queue are built in, so you don't need a separate anti-spam plugin, and comments, replies and threads are unlimited.
It costs site owners $0, with no ads and no hidden tiers. It will launch with an official WordPress plugin and a universal embed script for any other site, and WordPress comment import and full data exports are on the roadmap. It's in private early access: join the waitlist and we'll email your invite as rollout expands.
How the WordPress moderation queue works
WordPress keeps its controls under Settings > Discussion, and the defaults already form a light moderation system:
- "Comment must be manually approved" is off, but "Comment author must have a previously approved comment" is on. A first-time commenter waits in the queue; once approved, their later comments publish instantly.
- Any comment with 2 or more links is held, because "a common characteristic of comment spam is a large number of hyperlinks."
- Auto-closing comments on older posts is off, with 14 days as the preset if you switch it on.
Two text boxes handle keywords. Each checks the comment text, name, URL, email, IP and browser user-agent string, one entry per line:
- Comment Moderation holds matching comments in the queue for review.
- Disallowed Comment Keys (its name since WordPress 5.5, released August 11, 2020) sends matches straight to the Trash, which keeps items for 30 days by default.
Note: Both boxes match inside words, so "press" also catches "WordPress". Keep entries specific, or you will hold or trash comments that did nothing wrong.
Trust levels and first-comment approval
First-comment approval is the simplest trust system: strangers get screened, regulars don't. Larger platforms take the same idea further.
Discourse uses 5 trust levels, from TL0 (new) to TL4 (leader, promoted by staff only). A TL0 user can't flag posts, include more than 2 links in a post or post more than 10 replies. Reaching TL1 takes entering at least 5 topics, reading at least 30 posts and spending 10 minutes reading. Discourse also has a topic slow mode, added in version 2.6.0.beta5 in October 2020, which makes people wait a set time between posts.
YouTube Studio offers None, Basic, Strict and Hold all moderation levels and keeps held comments for up to 60 days. Reddit's Crowd Control filters by trust: Moderate catches accounts with negative community karma, High adds new accounts and Maximum adds non-members. The same tools do most of the work when you're dealing with trolls.
Automated classifiers in 2026
When keyword lists stop scaling, an API can score each comment before or right after it publishes. Here's where the main options stand as of October 2026:
- Perspective API (Google Jigsaw): free, with a default quota of 1 query per second, but it's sunsetting. It stays active until December 31, 2026, and stopped accepting new usage and quota requests after February 2026, so don't build on it now.
- OpenAI moderation endpoint: free to use with the omni-moderation-latest model. It checks text and images across 13 categories, such as harassment, hate, self-harm and violence, and returns a flag plus a 0 to 1 score for each.
- Azure AI Content Safety: 5,000 free text records a month, then $0.375 per 1,000 records. One record is up to 1,000 characters.
- Google Cloud Natural Language: the first 50,000 units of text moderation each month are free, scored across 16 categories including Toxic, Insult and Profanity.
Spam is a separate problem with its own tools: CommentCamp filters it for $0, while Akismet's Pro plan costs $9.95 a month billed yearly for 500 spam checks. Our comment spam guide covers that side.
Tip: Use classifier scores to hold comments, not to delete them. Let a person make the final call on anything near your threshold.
Response times and workload math
Pick a response target you can actually keep, such as clearing the queue every morning and evening, and tell readers when held comments get reviewed. The Tyee, a Canadian news site, says a comment caught by its filter can take "a few minutes to several hours" to approve.
Then do the math. At about 15 seconds per comment, 200 comments a day is 50 minutes of moderation every day. At newsroom scale it gets heavy: in 2016, The New York Times had 14 moderators reviewing about 11,000 comments a day, and because of that labor, commenting was open on only about 10% of its articles.
Rotate who moderates, and mix routine queue checks with the ugly threads. In a 2019 experiment where 747 people each moderated 78 comments, those who handled only uncivil comments reported more emotional exhaustion.
Publish your rules where people comment
Write your rules in plain English and link them right above the comment box. Our community guidelines template is a good starting point.
Then make reporting obvious. In a 2017 Coral Project survey of more than 12,000 commenters at 20 news sites, only 62% knew their site had a way to report offensive comments, even though every site had one.
Enforce the rules the same way every time. A 2023 study of 412 million Facebook comments found that deleting rule-breaking comments reduced later rule-breaking in threads of 20 comments or fewer, while hiding them had small, statistically insignificant effects.
Frequently asked questions
How does WordPress comment moderation work by default?
Out of the box, WordPress holds a first-time commenter's comment until you approve it, because 'Comment author must have a previously approved comment' is switched on. It also holds any comment with 2 or more links. After one approved comment, a person's later comments publish instantly unless they trip another rule.
What is the difference between Comment Moderation and Disallowed Comment Keys in WordPress?
Both boxes check a comment's text, name, URL, email, IP and user agent, and both match inside words. A match in Comment Moderation holds the comment in your queue for review. A match in Disallowed Comment Keys sends it straight to the Trash, or marks it as spam if trash is disabled.
Is Google's Perspective API still available for comment moderation?
Only until the end of 2026. Google Jigsaw says Perspective API is sunsetting and will stay active until December 31, 2026, and it stopped accepting new usage and quota requests after February 2026. For new projects, look at the OpenAI moderation endpoint, Azure AI Content Safety or Google Cloud Natural Language.
How much do comment moderation APIs cost?
As of October 2026, OpenAI's moderation endpoint is free to use. Google Cloud Natural Language includes 50,000 free text moderation units a month, and Azure AI Content Safety includes 5,000 free text records a month, then charges $0.375 per 1,000 records of up to 1,000 characters each.
Should I delete or hide comments that break my rules?
Deleting works better in small threads. A 2023 study of 412 million Facebook comments by Ribeiro, Cheng and West found that deleting rule-breaking comments reduced later rule-breaking in threads with 20 or fewer comments, while hiding them had small, statistically insignificant effects.
Sources
- wordpress.org/documentation/article/settings-discussion-screen
- perspectiveapi.com
- developers.openai.com/api/docs/guides/moderation
- azure.microsoft.com/en-us/pricing/details/content-safety
- cloud.google.com/products/natural-language/pricing
- blog.discourse.org/2018/06/understanding-discourse-trust-levels
- support.google.com/youtube/answer/9483359
- support.reddithelp.com/hc/en-us/articles/15484545006996-Crowd...
- nytco.com/press/the-times-is-partnering-with-jigsaw-to-expand...
- thetyee.ca/About/Commenting
- guides.coralproject.net/12000-people-have-something-to-say
- arxiv.org/abs/2210.10454
- mediaengagement.org/research/moderating-uncivil-comments
- mediaengagement.org/research/survey-of-commenters-and-comment...
Prices and plan limits checked on October 30, 2026.