Native Comments
Visitor comments stored in AIGCS's own database
The Native Comments plugin enables visitor comments stored in AIGCS's own database.
Features
- Reply Threading — nested comment replies
- Edit Window — configurable time limit (default: 3 minutes)
- Admin PIN — password for comment moderation
- Email Notifications — new comment and reply alerts
- Gravatar Support — with proxy option
- Blocked Keywords — auto-reject comments containing specified words
- Email Domain Filter — whitelist/blacklist email domains
Configuration
The Native Comments plugin has 29 configurable settings in the admin panel:
| Setting | Type | Default | Description |
|---|---|---|---|
formPosition | string | top | Comment form position (top/bottom) |
aiPosition | string | above | AI vs visitor comment order |
requiredFields | string[] | ["author","email"] | Required form fields |
gravatarProxy | string | — | Gravatar proxy URL |
blockedKeywords | string[] | [] | Auto-reject keywords |
notifyOnReply | boolean | true | Email reply notifications |
Enable
- Go to Plugins in the admin panel
- Find Native Comment Plugin in the plugin list
- Toggle to enable (changes take effect immediately)
Site Owner Anti-Impersonation (Admin PIN)
The native plugin enforces a strict anti-impersonation feature. When a visitor attempts to submit a comment using an email address that belongs to the site's administrator list, the system will require them to provide the correct Admin PIN (configurable in the backend). If the correct PIN is not provided, the submission is rejected. This guarantees that no one can impersonate the site owner in the comment section.
Comment Deletion Mechanism and Security
AIGCS has designed a strict secure soft-deletion mechanism for the native comment plugin to ensure privacy and prevent abuse:
- Ownership Verification: Visitors must request deletion using the exact email address they originally used to post the comment.
- Email Verification Code: The system sends a high-entropy, 6-digit one-time verification code to the email, valid for 30 minutes. This heavily relies on a correctly configured SMTP service in the backend.
- Soft Delete and Privacy Erasure: To prevent breaking the comment tree structure, the system performs a "soft delete" upon successful verification. The comment content is replaced with "This comment has been deleted by the author", and the system completely erases the author's email and website URL (PII) at the database level.
- Anti-Brute Force: A verification code is immediately invalidated upon a single incorrect attempt. A single email can request a maximum of 5 codes within 24 hours, with a mandatory 120-second cooldown between each request, fundamentally eliminating malicious spamming and brute-force attacks.