Once comments are open, spam follows. Most of it is predictable: links to shops, repeated text, bursts from one address, and messages in a language your readers don’t use. Some of it is harder to spot, such as hostile or abusive comments that contain no obvious keywords.
This guide covers EmDash’s own options first, then where rules-based checks fit.
EmDash’s built-in moderation setting
Comments are set per collection.
- Open the collection under Content Types.
- Turn on Enable comments.
- Under Moderation, choose one: – All comments require approval – First-time commenters only – No moderation (auto-approve all)
- Optional: turn on Auto-approve authenticated users, so comments from logged-in CMS users are approved.
- Optional: set Close comments after (days). Use 0 to never close comments automatically.
Held comments wait in EmDash’s Comments screen for you to approve, or mark as spam.
This works well on a quiet site. “All comments require approval” keeps spam off the page, but you still review every comment by hand. “First-time commenters only” cuts that work, but it lets anything through from someone with one approved comment.
The official AI Moderation plugin
EmDash’s AI Moderation plugin (@emdash-cms/plugin-ai-moderation) sends each new comment to Cloudflare Workers AI, which runs Llama Guard 3 8B. It needs a Workers AI binding.
It checks comments against categories: Spam, Toxic Comment, Trolling, Harassment, Hate Speech, Misinformation and Child Safety. Each category is set to block, hold or ignore. You can edit the categories on its settings page.
Its Auto-approve clean comments setting is on by default. Comments the model rates clean are approved, even on collections that hold comments for review. If the AI check fails, the comment is held.
Its strength is judging meaning. It can catch a rude or harassing comment that contains no blocked word.
Where rules-based checks help
Many spam comments don’t need a model to spot. They have too many links, repeat text already posted, arrive in bursts, or come from an address you have already blocked. Fixed rules handle those cases predictably, and they tell you exactly why a comment was held.
Comment Spam Protection is a rules-based plugin for this. Peachfin Themes makes Comment Spam Protection.
Everything runs on your own site. It uses no outside service, no account and no API key, and makes no network requests.
Set up Comment Spam Protection
You need EmDash 1.0 or later with a plugin sandbox runner. On Cloudflare, that means the Workers Paid plan and a Worker Loader binding. Comments must be on for at least one collection.
- Install Comment Spam Protection from the plugin registry.
- Review the permissions and confirm.
- Open Comment rules. Defaults are already on: – Common spam phrases: spam. – More than 2 links: held for review. – Mostly an unexpected alphabet, based on your site’s language: held. – The same text again within 24 hours: held. – More than 3 comments in 10 minutes from one address: held. – Everything else: your collection’s own EmDash setting.
- Add words, patterns or emails you want blocked or always approved.
- Open Try a comment and paste a sample comment to see what happens.
- In Settings, choose whether spam is kept in EmDash’s Spam list (the default) or refused, and how long the activity log is kept.
Then watch Comment activity. Each new comment shows the rule that decided and why, such as “3 links (limit 2)”. Use a row’s Actions menu to block that IP address, email or domain.
Rules run in a fixed order, and the first match decides. Blocks come first, because anyone can type any email address into a comment form. For each rule, you choose spam, hold for review, or approve.
Using rules and AI Moderation together
EmDash lets one plugin set the status of new comments. If another plugin already does, EmDash keeps that one. Comment Spam Protection’s Settings page shows which plugin decides.
If AI Moderation decides:
- Comment Spam Protection still checks every comment.
- It adds its result and reasons to the comment, and records them on Comment activity.
- Optionally, it moves spam to Spam and held comments to Pending right after they are saved.
- Refusing clear spam works in this case too.
This gives you both checks. The model judges tone and intent. The rules catch links, repeats, bursts and blocked senders, and show you the reason.
What Pro adds
Pro is a license key for the same plugin. It costs $29 a year for 1 site, $59 for 5 sites and $99 for unlimited sites.
- Score mode: matching rules add points, and you set the thresholds.
- Different rules for each collection.
- Re-check old comments, with a dry run first.
- CSV import and export of your lists, and the activity log as CSV.
- Statistics: comments per week, and what each rule caught.
- Weekly email to administrators.
Buy a key on the store page and paste it under Settings → License. The key is checked on your site, without contacting anyone.
Limits and caveats
- Rules match what you tell them to. They don’t judge tone, so new kinds of spam may need new words or patterns.
- EmDash gives plugins only a scrambled code for each IP address. You can block an address from a comment, but you can’t type one in.
- Patterns that could slow your site are refused when you save them.
- When a license expires, Pro settings you already saved keep working. Only changing them stops.
FAQ
Does it send comments anywhere?
No. Every check runs on your site, and license keys are checked there too.
What happens to spam?
By default it is saved with the status Spam, so you can review and restore it in EmDash’s Comments screen. If you choose to refuse clear spam, the visitor sees an error and nothing is saved. Refused comments are still listed on Comment activity.
Will my regular commenters be held?
Signed-in members are approved unless a blocked email, word or pattern applies. You can also trust people who already have approved comments.
Do I need AI Moderation as well?
Not necessarily. On a site with mostly link and repeat spam, rules may be enough. If abusive or hostile comments are a problem, the two work together as described above.