{"id":359496,"date":"2026-08-28T04:02:18","date_gmt":"2026-08-28T04:02:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/delta-dev-comment-lockdown\/"},"modified":"2026-08-28T04:01:55","modified_gmt":"2026-08-28T04:01:55","slug":"delta-dev-comment-lockdown","status":"publish","type":"plugin","link":"https:\/\/lin.wordpress.org\/plugins\/delta-dev-comment-lockdown\/","author":23501835,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.1","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"Delta Dev Comment Lockdown","header_author":"Delta Dev","header_description":"Security-focused WordPress comment attack-surface lockdown with layered protection for frontend, REST, XML-RPC, pingbacks, feeds, and admin UI.","assets_banners_color":"375d87","last_updated":"2026-08-28 04:01:55","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/deltadeveloperbd.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":59,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"deltadevbd","date":"2026-08-28 04:01:55","revision":3669749}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3669757,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3669757,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3669757,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3669757,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[277990,14833,31093,10612,23853],"plugin_category":[],"plugin_contributors":[],"plugin_business_model":[],"class_list":["post-359496","plugin","type-plugin","status-publish","hentry","plugin_tags-comment-security","plugin_tags-disable-comments","plugin_tags-hardening","plugin_tags-pingbacks","plugin_tags-rest-api","plugin_committers-deltadevbd"],"banners":{"banner":"https:\/\/ps.w.org\/delta-dev-comment-lockdown\/assets\/banner-772x250.png?rev=3669757","banner_2x":"https:\/\/ps.w.org\/delta-dev-comment-lockdown\/assets\/banner-1544x500.png?rev=3669757","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/delta-dev-comment-lockdown\/assets\/icon-128x128.png?rev=3669757","icon_2x":"https:\/\/ps.w.org\/delta-dev-comment-lockdown\/assets\/icon-256x256.png?rev=3669757","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Delta Dev Comment Lockdown is a security-focused comment attack-surface hardening plugin developed by Delta Dev for WordPress sites that do not need the native comment system.<\/p>\n\n<p>Instead of only hiding a comment form, the plugin applies multiple independent WordPress-native protection layers. It closes public commenting, blocks direct and core comment creation paths, removes core REST comment routes, disables comment-related XML-RPC\/pingback surfaces, blocks comment feeds, and can remove related admin surfaces. It does not modify WordPress core files and it does not delete existing comments.<\/p>\n\n<p>Default protections include:<\/p>\n\n<ul>\n<li>Forces comments closed on the public site.<\/li>\n<li>Hides existing comments without deleting them.<\/li>\n<li>Blocks normal WordPress comment submissions with HTTP 403.<\/li>\n<li>Stops new comments in the core comment approval pipeline.<\/li>\n<li>Removes and blocks the core REST API <code>\/wp\/v2\/comments<\/code> endpoints.<\/li>\n<li>Disables pingbacks and trackbacks.<\/li>\n<li>Removes WordPress XML-RPC comment and pingback methods.<\/li>\n<li>Removes the <code>X-Pingback<\/code> response header.<\/li>\n<li>Disables comment-feed discovery links and direct comment-feed requests.<\/li>\n<li>Removes Comments and Trackbacks support from registered post types.<\/li>\n<li>Hides the Comments admin menu, toolbar item, and Recent Comments dashboard widget.<\/li>\n<\/ul>\n\n<p>All protections can be configured from <strong>Settings &gt; Comment Lockdown<\/strong>. Strict protection is enabled by default.<\/p>\n\n<h4>Security design<\/h4>\n\n<ul>\n<li>Uses WordPress core hooks and APIs instead of modifying core files.<\/li>\n<li>Uses a defense-in-depth approach so disabling a theme comment form is not the only control.<\/li>\n<li>Settings are restricted to administrators with <code>manage_options<\/code>.<\/li>\n<li>Settings are saved through the WordPress Settings API and sanitized to strict boolean values.<\/li>\n<li>Admin output is escaped before rendering.<\/li>\n<li>No arbitrary code execution, file manager, remote executable downloads, telemetry, licensing gate, or external service is included.<\/li>\n<\/ul>\n\n<h4>Privacy<\/h4>\n\n<p>Delta Dev Comment Lockdown does not collect, store, transmit, or sell personal data. It does not use analytics, telemetry, cookies, external APIs, or third-party services.<\/p>\n\n<h4>Compatibility note<\/h4>\n\n<p>Some plugins use the native WordPress comment system for other features. WooCommerce product reviews are a common example. Enabling all protections can disable those comment-based review flows.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>In WordPress, go to <strong>Plugins &gt; Add Plugin &gt; Upload Plugin<\/strong>.<\/li>\n<li>Upload the Delta Dev Comment Lockdown ZIP file and activate the plugin.<\/li>\n<li>Open <strong>Settings &gt; Comment Lockdown<\/strong>.<\/li>\n<li>Keep all options enabled for a strict site-wide comment shutdown, or adjust individual protections as needed.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20the%20plugin%20delete%20existing%20comments%3F\"><h3>Does the plugin delete existing comments?<\/h3><\/dt>\n<dd><p>No. Existing comments remain in the WordPress database. They can be hidden publicly while the plugin is active.<\/p><\/dd>\n<dt id=\"what%20happens%20after%20deactivation%3F\"><h3>What happens after deactivation?<\/h3><\/dt>\n<dd><p>All runtime protections stop. Existing WordPress comment data is left unchanged.<\/p><\/dd>\n<dt id=\"does%20this%20block%20rest%20api%20comments%3F\"><h3>Does this block REST API comments?<\/h3><\/dt>\n<dd><p>Yes. The plugin removes the core comment endpoints and also blocks matching requests as a defense-in-depth measure.<\/p><\/dd>\n<dt id=\"does%20it%20disable%20xml-rpc%20completely%3F\"><h3>Does it disable XML-RPC completely?<\/h3><\/dt>\n<dd><p>No. It removes comment and pingback XML-RPC methods while leaving unrelated XML-RPC functionality available for plugins or services that may still need it.<\/p><\/dd>\n<dt id=\"does%20it%20affect%20woocommerce%20product%20reviews%3F\"><h3>Does it affect WooCommerce product reviews?<\/h3><\/dt>\n<dd><p>It can. WooCommerce product reviews use the WordPress comment system. If you need product reviews, do not enable protections that conflict with your review workflow.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20send%20data%20to%20delta%20dev%3F\"><h3>Does the plugin send data to Delta Dev?<\/h3><\/dt>\n<dd><p>No. The plugin has no telemetry, tracking, external API calls, or phone-home functionality.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial public release.<\/li>\n<li>Added frontend comment shutdown.<\/li>\n<li>Added direct submission and core comment insertion protection.<\/li>\n<li>Added REST API comment blocking.<\/li>\n<li>Added pingback, trackback, XML-RPC, and comment-feed protection.<\/li>\n<li>Added configurable admin UI controls.<\/li>\n<li>Added privacy-friendly, no-telemetry defaults.<\/li>\n<\/ul>","raw_excerpt":"Lock down the WordPress comment attack surface with layered protections while preserving existing comment data.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/359496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=359496"}],"author":[{"embeddable":true,"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/deltadevbd"}],"wp:attachment":[{"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=359496"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=359496"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=359496"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=359496"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=359496"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/lin.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=359496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}