Discussion settings

Comments are a form on your site, not just a feature

A comment box is a public form that writes to your database and then republishes what it collects, which is worth remembering before treating comment settings as a minor content preference. Requiring a name and email, requiring registration before anyone can post, deciding whether new posts accept comments at all: these are the settings that decide whether that form is open to anyone on the internet or has at least one hurdle in front of it, and the difference shows up directly in how much spam ends up in the moderation queue.

The two “keep it at zero” checks in this group are less about security and more about the queue actually getting worked: a pending-moderation count that only grows is a sign nobody is checking it, which matters because spam comments are rarely just annoying. Links planted in a comment field are a cheap way to build backlinks to whatever the spammer is promoting, sometimes to outright scam or malware sites, published under your client’s domain the moment a comment goes live unmoderated or sits pre-approved. A trashed-comments count that never gets emptied is smaller stakes, just database weight nobody is clearing.

Across a portfolio, this is one of the lower-severity groups here, but it is not a nothing group: an agency running dozens of client blogs with comments switched on and no moderation discipline is running dozens of small, low-effort spam magnets, and the fix in every case is the same handful of settings applied consistently rather than solved once per site.