CommentAura
Keep the discussion on the design itself, please — comparison spam gets removed.
Like Reply 2h12 August 2026
WordPress plugin · Free and GPL
Comments that stay WordPress comments.
Threading, voting, reactions, subscriptions and editing — all of it stored in
your own wp_comments table. Turn CommentAura off and every comment,
reply and permalink still works.
- No iframe
- No third‑party requests
- Works without JavaScript
… which is why the comment table is the only part of a discussion plugin that really matters.
The part nobody checks before installing: where does this actually put my comments?
31Like Reply 1h13 August 2026
wp_comments, same as core. That is the entire answer.
Love
Reply
5m14 August 2026
Every control you see is CommentAura's. The bubbles, faces and short dates went — they are the plugin's own. Three comments, three authors, one reply nested under its parent. Not one of them moved.
Zero lock‑in
There is no second server in the path
A hosted comment service puts somebody else's machine between your readers and your discussion. CommentAura does not have a machine. Every comment is selected from your own database and returned inside your own page.
Your comments are never moved
Everything lives in wp_comments and wp_commentmeta, where
WordPress already puts it. No iframe, no external account for your visitors.
Uninstalling removes CommentAura's own tables and never touches a comment.
It runs without JavaScript
The thread is rendered on the server, inside your page's HTML. Reading, posting, editing, voting and reacting are all plain form submissions — which is also why search engines index the discussion and screen readers can read it.
Nothing is sent anywhere
No trackers, no CDN, no analytics beacon, no sponsored content in your discussions. The plugin makes zero outbound HTTP requests, and guest identities are stored as a one‑way salted hash rather than a raw IP address.
Performance
Measured, not asserted
Comment plugins have a reputation for being the heaviest thing on a page. These are the four numbers that reputation is built on, and what CommentAura does about each.
0 KB
loaded on a page with no comment thread. Not a small file — none at all.
Flat
queries per thread, whether a post has ten comments or ten thousand.
0
outbound HTTP requests. There is no service to be slow or to go down.
100%
of the thread is in the HTML before a single line of script runs.
Replies are fetched per level, not per comment
The usual failure is one query per comment to find its children, which turns a popular post into a slow one. CommentAura reads a whole nesting level at a time, so the query count is decided by thread depth and never by thread size.
Nothing loads until there is something to render
A page with no discussion on it gets no stylesheet, no script and no inline payload from CommentAura. The decision is made early enough in the request to keep the asset off the page entirely, rather than shipping it and hiding it.
Page caching is not a special case
Reading a thread sets no cookies and needs no per‑visitor state, so a post with comments caches exactly like a post without them. Posting goes through WordPress's own comment handler, which is never served from a cache.
Screens
Quiet on the front. Plain in the back.
Real screens from a real install, not mock-ups — and not a state the plugin cannot actually reach.
The three admin screens are too wide to read on a phone. They are on the WordPress.org listing at full size.
Features
A discussion system, not a stylesheet
Every one of these is in the free plugin today. None of them is a preview, a trial, or a greyed-out row waiting for a licence key.
Threaded discussions
Classic and block themes, with byte-identical output through either path.
Comment subscriptions
Proper double opt-in — nobody is emailed until they confirm — with one-click unsubscribe on every notification.
Voting
Duplicate prevention enforced by a database constraint, not by hopeful bookkeeping.
3D reactions
Rest on Like, long-press on a phone, or press Enter, and a bar of 3D faces opens. Choose which faces, their order, names and icons in Settings.
Comment editing
For as long as you allow. Every earlier version is kept in your database, and an edit goes through the same spam checks as a new comment.
Pinned comments and closing
Lift a comment above the paged flow, or close a discussion per post.
A spam baseline, no CAPTCHA
An invisible honeypot and a timing check. CAPTCHAs tax every honest reader to inconvenience a bot that solves them for a fraction of a cent. Works alongside Akismet.
Rate limiting that is fair
Core matches floods on IP or email, so two strangers behind one office network block each other. CommentAura keys on identity and address together.
Cache-safe guest commenting
Permission to post is fetched at the moment of posting, so it is never stale inside a fully cached page.
Full GDPR support
Registered with WordPress's own personal-data exporter and eraser, so the built-in request flow just works.
A documented REST API
Routes under commentaura/v1, with a permission callback on every
one of them.
Overridable templates
Copy any partial into your theme. Callbacks are named throughout, so hooks can actually be removed.
PSR-4, PHP 8.1+, strict types, PHPStan level 8. The plugin is GPLv2 or later, and the whole of it is on WordPress.org where you can read it before you install it.
Moving in and out
Coming in is easy. Leaving is easier.
A plugin that is hard to leave is not earning your loyalty, it is holding it. Every tool below is in the free version, and will stay there.
Import from Disqus
Point it at your Disqus export. Threads are matched to your posts by URL — including your old domain, since leaving Disqus usually follows a domain change — and a discussion that cannot be matched is skipped rather than attached to the wrong post. Re-running the same file imports nothing twice.
Switch from another plugin
wpDiscuz, Jetpack Comments and Subscribe to Comments Reloaded already store
comments in wp_comments, so there is nothing to migrate. CommentAura
brings across the part that would otherwise be lost: subscriber lists and votes.
Nothing is deleted from the other plugin.
Export everything, any time
Download every comment on the site as JSON, streamed in batches so the size of your site does not decide whether the export finishes. WordPress's own exporter works too — this exists so that leaving is never blocked on a tool you do not have.
Dry run first, always. Every import previews exactly what it would do before anything is written, and that is the default rather than an option you have to find.
One thing Disqus will not give you. Exports produced since 2019 contain no email addresses and no IP addresses for guest commenters. CommentAura keeps the display name, imports with an empty address, and tells you how many were affected — rather than letting you find out from a support ticket.
Roadmap
What is out, and what comes next
CommentAura is built by one person with no investor clock running, so the plan is sequenced rather than dated. Each stage ships when the one before it has evidence behind it — and a stage is delayed rather than shipped soft.
-
Available now
CommentAura — the whole discussion layer
Threading, sorting, permalinks and pagination. Guest commenting that survives page caching. Editing that keeps every earlier version. Votes, reactions, pinned comments and per-post closing. Subscriptions with double opt-in. The Disqus importer, the plugin migrations and the full export. Spam baseline, GDPR, REST API and hooks. All of it works with JavaScript switched off, and since 1.0 voting, replies, edits and “load more” also happen without a page reload. Hooks let add-ons extend it or replace any part of it.
-
Available now
Pro 1.0 — the moderation suite
A separate paid add-on, sold on waafaa.com: a keyboard-first moderation queue with bulk actions and undo; a pre-moderation rules engine; AI triage and toxicity scoring on your key, with almost any AI company; a delegated moderator role, front-end moderation and reader reports; reaction extras; engagement analytics; post-comment conversion actions and @mentions; and hardened media uploads.
-
Next
1.x — proven in the wild
The proof, published as it arrives: the 20 most-used themes and a matrix of caching setups on real hosts, an independent security audit and a benchmark page. Polish driven by support tickets, because a ticket is research that arrived for free.
-
Planned
1.x — compounding on the base
Email digests, once there is real deliverability data from subscriptions to build them on. Commenter badges, once engagement data says they would be used rather than merely displayed. An agency programme. Social login only if account friction turns out to be what stops people commenting — and only a few providers, hardened. Digests and badges would join Pro, because they serve the site owner; social login would be free, because it serves the commenter.
-
Direction, not commitment
The long lines
Metered AI for people who would rather not hold an API key. Optional hosted conveniences, such as managed email sending and agency dashboards, that never cripple the plugin when you decline them. Live-updating threads, which are deliberately not in the product today. Inline comments anchored to a paragraph. WooCommerce reviews and Q&A.
Free and Pro
Free for the reader and the blogger. Pro for the moderator.
The free plugin is complete, not a demo. Pro is a separate add-on that runs on top of it and adds the tools for whoever has to keep a busy comment section healthy. Pro includes everything in Free.
| Feature | Free Available now | Pro From $29 a year |
|---|---|---|
| The discussion | ||
| Threaded comments, sorting, permalinks and pagination | Included | Included |
| Guest commenting that works with page caching | Included | Included |
| Comment editing, with an edit history | Included | Included |
| Voting and reactions | Included | Included |
| 3D reaction faces: choose, reorder, rename and swap iconsHover, long-press or keyboard; votes optional | Included | Included |
| Pinned comments and per-post closing | Included | Included |
| Reply notifications and subscriptionsDouble opt-in, one-click unsubscribe | Included | Included |
| Classic and block themes | Included | Included |
| Works with JavaScript switched off | Included | Included |
| Moving in and out | ||
| Disqus importer | Included | Included |
| wpDiscuz, Jetpack and Subscribe to Comments Reloaded migration | Included | Included |
| Full JSON export | Included | Included |
| Trust and privacy | ||
| Spam baseline and fair rate limitingHoneypot and timing check, no CAPTCHA | Included | Included |
| GDPR export, erasure and clean uninstall | Included | Included |
| Sends nothing to a third partyPro checks its licence, and calls your own AI provider only if you turn AI on | Included | Licence + your AI |
| For developers | ||
| REST API, hooks and overridable templates | Included | Included |
| Moderation · Pro | ||
| Keyboard-first moderation queue, with bulk actions and undoFree keeps WordPress’s own Comments screen | Core screen | Included |
| Pre-moderation rules engine | Not included | Included |
| AI triage and toxicity scoringOn your own API key, never ours | Not included | Included |
| Moderator role, front-end moderation and reader flags | Not included | Included |
| Reactions · Pro | ||
| Upload your own reaction iconsPNG or WebP, re-encoded on upload | Not included | Included |
| Different reactions per post type or per post | Not included | Included |
| Reaction reports: most-used reactions and top reacted comments | Not included | Included |
| Audience · Pro | ||
| Engagement analytics | Not included | Included |
| Post-comment conversion actions and @mentions | Not included | Included |
| Hardened media uploads | Not included | Included |
| Support | ||
| Help when something breaks | Public forum | Priority |
Pro includes everything in Free. Nothing here marked as free will move into Pro. See Pro pricing.
Pro pricing
One bundle with every Pro feature, priced by the number of sites and never by feature. Pay monthly, yearly, or once. Choose a plan.
- Solo · 1 site $29 per year or $9 per month, or $99 once for life
- Studio · 5 sites $59 per year or $29 per month, or $199 once for life
- Agency · Unlimited sites $149 per year or $59 per month, or $399 once for life
- Renews at the same price, and the renewal price is always shown up front.
- If you stop renewing, Pro keeps working. Only updates and support stop.
- Everything free today stays free. The list is right below.
- No trial, no refunds and no coupons. The free plugin is complete on its own: buy Pro when you need the moderation tools.
Six things that will never move behind a paywall
Whatever Pro turns out to be, it will not be built by taking these away. They are the reason to trust the free plugin, and charging for any one of them would turn CommentAura into the thing it was written to replace.
- Every importer, and the full export
- The spam and security baseline
- GDPR export, erasure and clean uninstall
- Reply notifications and subscriptions
- The public REST API, hooks and templates
- Cache and theme compatibility
Questions
Asked first, usually
Will I lose my comments if I deactivate this?
No — this is the entire point of the plugin. Comments live in WordPress's own tables the whole time. Deactivate CommentAura and your theme's normal comment display returns, with every comment, reply and link intact.
Does it work with page caching?
Yes. The thread is rendered into the page itself and sets no cookies, so a post with comments caches exactly like a post without them.
Posting goes through WordPress's own comment handler as a normal form submission, which is never served from a cache — so commenting works on a fully cached page without the plugin having to punch a hole in it.
Does it work with block themes?
Yes. CommentAura integrates with both the classic
comments_template() path and the block editor's
core/comments block, and produces identical output through either.
Do my visitors need JavaScript?
No. Reading, posting, editing, voting and reacting all work with JavaScript disabled, because all of them are plain form submissions.
Is there a CAPTCHA?
No, and that is deliberate. A CAPTCHA taxes every honest reader in order to inconvenience a bot that can solve it for a fraction of a cent. There is an invisible honeypot and a timing check instead, which cost your readers nothing.
Where are votes and reactions stored?
In CommentAura's own tables, because they do not fit WordPress's comment schema. The comments themselves are never copied, shadowed or moved — which is why the votes go quiet if you deactivate the plugin while the discussion does not.
Does it send anything to a third party?
No. There are no third-party requests of any kind — no analytics, no CDN, no phone-home. Guest identities are stored as a one-way salted hash rather than a raw IP address.
What does uninstalling remove?
Only CommentAura's own tables and options, and only if you tick the box that says so. Your comments are WordPress's, not the plugin's, and are never touched.
How much does Pro cost?
Pro costs $29 a year for one site, $59 for five sites and $149 for unlimited sites. You can also pay monthly ($9, $29 or $59) or once for life ($99, $199 or $399). It is one bundle with every Pro feature, priced by site count and never by feature. It renews at the same price, and if you stop renewing it keeps working; only updates and support stop.
Every plan and price is on the pricing page.
Nothing listed on this page as free is going to become part of it. That list is in Free vs Pro, in writing, ahead of the product it constrains.
Is there a Pro trial, or a refund?
No to both, and no coupons either. The free plugin is the trial: it is the whole discussion layer, with no time limit. Buy Pro when you need the moderation and audience tools, and not before.
Is Pro a separate plugin?
Yes. Pro is an add-on installed alongside the free plugin, which stays installed and keeps doing its job. Your comments stay in WordPress's own tables either way, so removing Pro never removes a comment.
What does it need to run?
WordPress 6.5 or newer and PHP 8.1 or newer. It works on single sites and on multisite, with classic themes and with block themes, and it is licensed GPLv2 or later.
Install it, and it is already working
There is nothing to import, connect, or sign up for. Your existing comments are already where CommentAura reads them from.
- Open Plugins → Add New and search for CommentAura.
- Install it, then activate it.
- That is it. Settings live under CommentAura → Settings, and there are deliberately few.
- WordPress 6.5+
- PHP 8.1+
- Multisite ready
- GPLv2 or later
- Version 1.0.0
Documentation
Where the answers live
One guide covers the free plugin and Pro, screen by screen, in plain words.
The user guide
Install, every setting, importing from Disqus and other plugins, moderation, AI triage, privacy and what happens when you uninstall.
For developers
REST routes live under commentaura/v1, hooks and filters under
commentaura_, and every thread template can be copied into your theme.
The guide lists them.
Reporting a security issue
Please do not post a vulnerability in the public forum. Email it privately, with steps to reproduce and the version you tested, and it will be fixed before it is discussed in public.
Changelog
What changed, release by release
Newest first. Every release of the free plugin is listed here, with the same notes WordPress shows under Plugins → View details → Changelog. What is planned but not built yet lives in the roadmap, not here.
-
Next
In development Not released yetNothing finished yet. Changes are listed here as they are done; what is planned is in the roadmap.
-
1.0.0
LatestA new, familiar look with 3D reactions. Comments now work without page reloads, and two bugs that made comments look lost are fixed.
- NewA redesigned comment section: soft comment bubbles, a quiet Like, Reply and time row, and a "⋯" menu that keeps moderator tools out of readers’ way.
- New3D reactions. Rest on Like, long-press on a phone, or press Enter to open a bar of faces. Each person holds one reaction per comment.
- NewReaction settings under Engagement. Choose from 16 faces or add your own, reorder, rename and swap icons, with a live preview.
- NewSort comments by Top, Newest or Oldest.
- ImprovedVoting is off by default on new sites, because reactions are now the main feedback. Existing sites keep voting as they had it.
- NewVoting, reacting, replying, editing and loading more comments now happen in place, without reloading the page. Everything still works with JavaScript switched off.
- NewA comment box with a formatting toolbar and keyboard shortcuts, and an unsent comment is kept in your browser if you leave the page by accident.
- NewLong reply chains fold behind "View more replies".
- ImprovedA cleaner, simpler look for every CommentAura admin screen and a tighter comment thread, with far less text to read.
- NewA setting to switch the interactive parts off, which leaves no CommentAura script on any page.
- NewAn Upgrade page, last in the CommentAura menu, describing the optional paid add-on. There are no notices or banners anywhere else.
- ImprovedSigned-in visitors see one short "Signed in as" line above the comment box.
- ImprovedWhen a visitor edits an approved comment, the new text goes through the same spam and moderation checks as a new comment.
- FixedHeld, spam and trashed comments can no longer be voted on or reacted to.
- FixedA spam comment no longer sends a subscription confirmation email, and a pending subscription is re-sent at most once a day.
- FixedDisqus imports from the Import / Export screen were refused with "Sorry, you are not allowed to upload this file type".
- FixedA guest who did not tick "Save my name" could not see their own comment while it waited for moderation, so it looked lost.
- ImprovedLong threads render faster: replies are fetched once per level instead of once per comment.
- ImprovedThe plugin’s homepage link now points to waafaa.com/product/commentaura/.
- DevelopersNew filters
commentaura_island_scripts(load an add-on’s own script the same lazy way) andcommentaura_collapse_after. - DevelopersNew filters
commentaura_reaction_iconandcommentaura_reaction_set_for_post, and thecommentaura_reaction_settings_renderedaction for adding fields to the Reactions settings.
-
0.2.0
Opens CommentAura to add-ons, and fixes one way a vote could count twice.
- FixedA visitor who votes as a guest and then logs in now holds one vote, not two.
- ImprovedThe plugin’s homepage link now points to waafaa.com/plugin/commentaura/.
- DevelopersNew
commentaura_loadedaction. Add-ons receive the objects that own CommentAura’s callbacks, so they can replace one withremove_action(). - DevelopersNew actions
commentaura_vote_cast,commentaura_reaction_set,commentaura_subscription_confirmedandcommentaura_subscription_removed. None of them passes who acted. - DevelopersNew filter
commentaura_comment_action_typesadds links to every comment’s action row, andcommentaura_thread_argssets page size, sort order and whether held comments are shown. - DevelopersAdd-ons can queue their own background jobs with the
commentaura_enqueue_jobaction.
-
0.1.0
The first public release, on WordPress.org. Everything below is new.
- NewThreaded comments for classic and block themes, with sorting, permalinks and pagination.
- NewGuest commenting that works on fully cached pages.
- NewComment editing, with every earlier version kept for moderators.
- NewVoting and reactions, with duplicates blocked by the database.
- NewPinned comments and per-post closing.
- NewReply notifications and subscriptions, with double opt-in and one-click unsubscribe.
- NewDisqus importer, and migration of subscribers and votes from wpDiscuz, Jetpack Comments and Subscribe to Comments Reloaded. Every import runs as a dry run first.
- NewExport of every comment as JSON.
- NewSpam baseline (honeypot and timing check, no CAPTCHA) and rate limiting that does not block shared networks.
- NewGDPR personal-data export and erasure, and a clean uninstall that never touches your comments.
- NewREST API under
commentaura/v1, hooks, and templates you can override in your theme. - NewA CommentAura admin menu with Dashboard, Settings and Import / Export screens.
- NewEverything works with JavaScript switched off, and nothing is sent to any third party.
Later the same day the directory listing gained screenshots, an icon and banners. That was a listing update only; no plugin code changed.
Every past version stays downloadable from the Development tab on WordPress.org.
Support
Something rendering wrong? Tell us which theme.
Theme and cache combinations are where a comment plugin actually breaks, and the only way to cover them is for somebody to hit one and say so. A report with the theme name and the caching plugin in it is worth more than a dozen stars.