CommentAura user guide

Install

Needs: WordPress 6.5 or newer and PHP 8.1 or newer.

1. In wp-admin, go to Plugins → Add New and search for CommentAura.
2. Click Install Now, then Activate.
3. Open any post with comments. Your existing comments are already there, in the new design.

There is nothing to set up first. A new CommentAura menu appears just under Comments, with Dashboard, Moderation, Import / Export, Settings and Upgrade to Pro.

The first five minutes

1. CommentAura → Dashboard. The Health panel checks your theme, caching, spam filter and email sending. “Everything is working” means you are done.
2. CommentAura → Settings → Engagement. Choose your reaction faces and whether readers can vote.
3. Coming from Disqus? Run the importer as a dry run first: Import from Disqus.

Your comments always stay in WordPress’s own comment tables. Switch CommentAura off and your theme’s normal comments come back, with every comment and reply.

What readers see

CommentAura replaces your theme’s comment section. It works the same in classic themes and block themes.

• Sorting: Top, Newest and Oldest. Shown once a post has 2 or more comments. Top puts the most reacted and voted first; replies always stay oldest first.
• Replies: nested as deep as Settings → Discussion in WordPress allows (5 levels by default). Long reply lists show 2 replies and a “View N more replies” button.
• Labels: “Author” for the post’s author, “Pinned” and “Edited”.
• Avatars: a coloured circle with the person’s initial, drawn on your site. No Gravatar request.
• Pages: follow WordPress’s “Break comments into pages” setting. With JavaScript on, “Show more comments” loads the next page in place.
• The comment box: “Write a comment…” and a Post button. With JavaScript on it adds a small toolbar (bold, italic, link, quote, code), opens replies in place, and keeps an unsent draft in the browser.
• Closed threads show “Comments are closed.” and hide Like and Reply.

Without JavaScript everything still works: reading, posting, replying, reacting, voting, sorting and editing are plain links and forms. Who may comment (guests or only registered users, name and email required) is set in WordPress’s own Settings → Discussion.

Reactions and votes

Reactions are on by default: Like, Love, Care, Haha, Wow, Sad and Angry. Rest on Like (or long-press on a phone, or press Enter) to open the bar of faces. Each person has one reaction per comment; picking the same face again removes it.

Change them in CommentAura → Settings → Engagement → Reactions:

• switch faces on or off, rename them, reorder them, or pick another of the 16 faces;
• Quick reaction: what one click on Like gives;
• Open the bar: on hover or long-press, or on click only;
• Summary: how many top faces show next to the total;
• Show on: which post types get reactions (Posts and Pages by default).

With only one face on, readers get a plain Like button. Switching a face off keeps its counts. Reset reactions to default brings back the standard seven.

Votes (▲ score ▼) are off by default. Turn them on in Settings → Engagement → Reader actions → Voting. Voting the same way again takes the vote back.

Editing comments

Commenters can fix their own comments from the “⋯” menu → Edit. Signed-in people can always find their comments; a guest can edit only in the same browser they posted from.

• Settings → Discussion → Editing: on or off (on by default).
• Time limit: in minutes. 0 means no limit.
• An edited comment shows “Edited”. Up to 20 earlier versions are kept in the database.
• An edit that trips your WordPress disallowed-words list goes back to moderation.

Reply emails

Under the comment box readers see “Notify me of new comments on this post by email.” It covers every new comment on that post.

1. The reader ticks it and posts.
2. They get one email: “Confirm your subscription”. Nothing else is sent until they click the link.
3. Each new approved comment on the post is emailed to them, with a one-click unsubscribe link.

Emails go out in the background, a few a minute, through WP-Cron (or Action Scheduler when installed). Turn the whole feature off in Settings → Engagement → Reply subscriptions.

Settings

CommentAura → Settings. Click Save Changes at the bottom.

Dashboard

CommentAura → Dashboard shows your numbers (published, awaiting review, spam, votes, reactions, subscribers) and a Health panel.

Each check is OK, Needs attention or Not detected. Only “Needs attention” is a problem, and it says how to fix it:

• Database: tables need updating → deactivate and reactivate CommentAura.
• Theme integration: CommentAura is not attached to your theme’s comments → see Troubleshooting.
• Spam baseline: the spam filter is off.
• Notification queue / Sending: emails are stuck, or WP-Cron is disabled on this site.

Pinning and closing

Approving, spamming and deleting comments happen in WordPress’s own Comments screen (CommentAura → Moderation opens it). CommentAura adds:

• Pin / Unpin: a link on each comment in the Comments screen, and in the comment’s “⋯” menu on the post. Pinned comments sit at the top of page one, in the order you pinned them. Up to 5 per post.
• Close discussion / Reopen discussion: a link on each post in the Posts and Pages lists.
• Delete in the “⋯” menu moves the comment to the trash, where it can be restored.

These need the “moderate comments” permission (Editors and Administrators).

Import from Disqus

1. In Disqus, export your comments (you get an .xml file by email).
2. Go to CommentAura → Import / Export → Import from Disqus.
3. Choose the file and click Run import with Import for real switched off. This is a dry run: it writes nothing and shows what would happen.
4. Check the numbers, then switch Import for real on and run it again.

• Threads are matched to posts by URL, including from an old domain.
• Deleted and spam comments are skipped. Running the same file twice skips what is already in.
• Replies keep their nesting. Imported comments are approved, and no emails are sent.
• Disqus exports have no guest email addresses, so those comments arrive with the name only.

Move from other plugins

Plugins like wpDiscuz, Jetpack Comments and Subscribe to Comments Reloaded already keep comments in WordPress, so your comments need no moving.

What CommentAura can bring over is shown under Import / Export → Migrate from another comment plugin, only when it finds data:

• Subscribe to Comments Reloaded subscriptions;
• wpDiscuz subscriptions;
• wpDiscuz votes from logged-in members (guest votes cannot be matched to a person).

Run it with Migrate for real off first. It is safe to run twice and deletes nothing from the old plugin.

Export

Import / Export → Export your comments → Download export gives you every comment on the site as one JSON file: author, email, website, date, text, status, parent and link. Votes, reactions and subscriptions are not in it.

Spam and rate limits

• Honeypot: a hidden field people never see. Bots fill it in.
• Timing check: a form sent in under 3 seconds is a bot.
• Caught comments go to Spam, not to nowhere, so a mistake can be recovered.
• Rate limit: 10 actions per hour per person by default, counted separately for comments, votes, reactions and edits. Editors and Administrators are never limited.
• Works alongside Akismet.

Privacy and GDPR

• Nothing is sent to anyone. No Gravatar, no fonts, no tracking. The free plugin makes no outside requests.
• Comments stay in WordPress’s tables. Votes, reactions and subscriptions are in CommentAura’s own tables.
• Guests are recognised by a one-way code made from their IP address, never the address itself.
• Cookies: reading sets none. A guest who comments gets one cookie, commentaura_author, for a year, so they can edit their own comment.
• With JavaScript on, drafts and the reader’s own votes and reactions are kept in their browser.
• Tools → Export / Erase Personal Data in WordPress include CommentAura: subscriptions, votes and reactions.

Deactivate and uninstall

• Deactivate: nothing is deleted. Your theme’s own comments come back, with every comment, reply and link.
• Delete the plugin with Settings → Data → On uninstall off (the default): CommentAura’s data is kept, in case you come back.
• With it on: votes, reactions, subscriptions, settings, pins, closed flags and edit history are deleted.

Comments are never deleted, in any case.

Install Pro and activate

1. Keep the free CommentAura plugin (1.0 or newer) installed and active. Pro runs on top of it.
2. After you buy, download commentaura-pro-1.0.0.zip from the email or your account.
3. Go to Plugins → Add New → Upload Plugin, upload the zip and activate.
4. Open CommentAura → Activate Pro and enter your licence key.

Once active, the CommentAura menu reads: Dashboard, Moderation, Analytics, Import / Export, Settings. Moderation has six tabs: Queue, Rules, AI triage, Moderators, After comments and What leaves your site.

Moderation queue

CommentAura → Moderation → Queue. Views: Pending, Reported, Spam, Approved and Trash, each with a count. Pending and Reported show the oldest first. 20 comments per page.

• Every key also has a button. Keys do nothing while you type in a field.
• Bulk: select with x or the checkboxes, up to 100 at once.
• Undo: for 10 minutes, only by the person who decided.
• Reply from the queue. Replying to a held comment approves it first.
• Each card shows the rule that caught it, the AI scores (“AI: spam 92 · toxic 3”) and reader reports.
• Last 30 days shows how fast your decisions are. Export CSV downloads them.

The queue needs JavaScript. Without it, use WordPress’s Comments screen.

Rules

Moderation → Rules. Checked on every new comment. Each rule can Hold for review (default), Mark as spam or Move to trash.

Rules only ever make things stricter; they never approve. When several match, the strictest action wins. Editors and Administrators are never held.

AI triage

Moderation → AI triage. Each new comment gets a spam score and a toxicity score (0–100) with a one-line reason, shown in the queue. It runs on your own account with an AI company, so they bill you directly, and it never slows a reader down.

1. Choose a Provider.
2. Paste your API key from that company’s website.
3. Leave Model empty to use the default, or type any model the company offers.
4. Click Save and test the key. “The provider accepted your key.” means it works.

What it does with a score

High spam score: Only show the score (default), Hold for review or Mark as spam, at a threshold from 50 to 100% (default 90). Only the spam score acts; toxicity is shown, never acted on. AI never approves a comment, and never overrides a decision a moderator already made.

Custom (OpenAI-compatible)

For any other service with an OpenAI-compatible API. Type its Base URL without chat/completions, for example https://api.example.com/v1/. It must start with https://, be a public internet address, and have no user name, password or ? part. It needs the PHP cURL extension (almost every host has it).

A server on your own network or localhost (Ollama, LM Studio) is refused unless a developer adds this line, for example in a small mu-plugin:

add_filter( 'commentaura_pro_ai_allow_local_http', '__return_true' );

Your key

• Stored in your database, never shown again, and only ever sent to the company or address it was saved for.
• Switch company or change the Base URL without typing a key, and the old key is removed. Enter it again.
• If the company rejects the key, runs out of credit or does not know the model, scoring pauses with one notice. Everything else keeps working. Save a new key, or test this one, to resume.

Sent for each new comment: its text, the author’s display name and the post title. Never email or IP addresses. Comments by Editors and Administrators are not scored. At most 60 calls a minute.

Moderators

Moderation → Moderators → Add a moderator: type a username or email and click Add moderator. Remove them from the list below.

A moderator gets the queue and on-post moderation, nothing else:

• they land on the queue when they log in;
• they see comments only on published posts they can read;
• they never see commenters’ email addresses;
• they cannot open settings, Analytics or other admin screens.

Editors and Administrators can already moderate and need no adding.

On-post moderation and reports

Moderate: people who can moderate see a “Moderate” link on each comment, with Approve, Hold, Spam and Trash right on the post. Held comments are shown to them in the thread, marked as waiting.

Report: readers can report a comment: Spam or advertising, Abusive or hateful, Off topic, False or misleading, or Something else. Set it up in Moderation → Rules → Reader reports:

• Let readers report a comment (on) and Including logged-out readers (on);
• Reports before review: 3 by default. Then the comment appears in the queue’s Reported view.

A report never hides a comment. One report per reader per comment, at most 20 an hour.

Reaction extras

All in the free plugin’s Settings → Engagement → Reactions, once Pro is active.

• Your own icons: a PNG or WebP up to 512 KB for any face that is on. Click Upload chosen icons. Each is checked, cropped square and resized to 128 px. Use the built-in face undoes it.
• Reactions per post type: tick which faces each post type offers. None ticked means the main set.
• Per post: a “Reactions” box in the post editor’s sidebar.

The post’s own choice wins, then its post type’s, then the site’s set. Reaction reports are on the Analytics page.

After someone comments

Moderation → After comments. Switch on Next step (off by default) to show one thing, once, only to the person who just commented:

• Related posts: up to 3, from the same category;
• Newsletter sign-up: Mailchimp, Kit (ConvertKit), Buttondown, or any service whose form field is named email. Paste your form address; emails go straight to the service, never through your site;
• Your own message: a line of text and a link.

Choose separately for first-time and returning commenters. It never shows for spam.

@mentions

Email people mentioned by name (on by default). Typing @ and a name emails that person, once the comment is approved. Only people who commented on the same post can be mentioned; at most 5 per comment and 3 emails a day to one address. Every email has a one-click “Stop mention emails” link.

Image uploads

Moderation → After comments → Image uploads (off by default) lets readers add one image to a comment.

• JPEG, PNG, WebP or GIF. Never SVG.
• Largest file: 4096 KB by default (100 to 10240).
• Images per person per day: 10 by default, counted over the last 24 hours.
• Every image is checked and re-saved: location and camera data are removed, a random file name is used, and anything wider than 1600 px is scaled down.
• Images are deleted with their comment. Adding one needs JavaScript.

Analytics

CommentAura → Analytics, over 7, 30 or 90 days:

• comments, first-time and returning commenters, votes, reactions and new subscribers;
• a chart of new comments per day (also as a table);
• most discussed posts, top commenters, most-used reactions and top reacted comments;
• Export CSV of the raw events.

It records what happened and when, never who. Events are kept 400 days. Reaction reports count from the day Pro was switched on.

What leaves your site

Moderation → What leaves your site lists every outside request Pro can make, and nothing else is sent:

On uninstall: the AI key is always deleted. Switch on Delete Pro’s data when Pro is deleted to also remove Pro’s tables, settings, reports, analytics and images. Comments are never touched. Deactivating deletes nothing.

Licence and renewals

• Your dashboard reminds you 7, 3 and 1 day before a yearly or monthly licence ends, with Renew now, Manage licence and Remind me later.
• A subscription that renews by itself gets one quiet note instead. Lifetime licences never see a reminder.
• If a licence ends, Pro keeps working. Updates, security fixes and support stop until you renew.
• At checkout, if your key is not filled in, choose “Renewing or upgrading?” and paste it from Manage licence.

Plans and prices: Pricing.

Troubleshooting

The comment section looks like my theme’s old one

Check Dashboard → Theme integration. A page builder or a theme that prints comments its own way can bypass WordPress’s comment template; ask your theme’s support, or a developer can use the commentaura_will_render_thread filter.

Reply emails do not arrive

Check Dashboard → Notification queue and Sending. “WP-Cron is disabled” means your host needs a real cron job. “Could not be sent” means your site’s email is failing; an SMTP plugin usually fixes it.

Readers are told to slow down too often

Your site is probably behind a CDN. Set Settings → Trusted proxy header, or raise the Rate limit.

A guest cannot edit their comment

Guests can edit only in the browser they posted from, within the time limit. After clearing cookies, they cannot.

Pro’s menu disappeared

Pro’s licence system hides its menu when your server cannot reach freemius.com. Ask your host to allow outgoing connections to it.

AI scoring says “paused”

Open Moderation → AI triage: the notice shows the company’s own reason (wrong key, no credit, unknown model). Fix it and click Save and test the key.

“Saved, except the base URL”

The Custom address was refused: it must be https://, public, and without a user name or ? part. The previous address was kept.

For developers

Every name starts with commentaura_. The most useful:

Templates: copy any file from the plugin’s views/thread/ to your-theme/commentaura/ to change it. Templates from 0.x must be copied again for 1.0. REST: write routes under /wp-json/commentaura/v1/ for comments, edits, votes and reactions.

Pro changelog

1.0.0 · 1 October 2026

• First release: moderation queue, rules, AI triage on your own key (Anthropic, OpenAI, OpenRouter, Google Gemini, DeepSeek, Mistral, Groq, xAI, or any OpenAI-compatible address), moderators, on-post moderation, reader reports, analytics, next-step panel, @mentions and image uploads.
• Reactions: your own reaction icons, reactions per post type and per post, and reaction reports.
• Licence renewal reminders in your dashboard.

The free plugin’s changelog is on the home page.

Getting help

• Free plugin: the WordPress.org support forum.
• Pro: priority support by email, waafaaofficial@gmail.com. Include your site address and Pro version.
• Security problems: email privately, never in the forum.