DawsonyWeb Spam Protection and API Hardening

Stop comment spam and close off parts of WordPress that bots abuse, without installing a heavy security suite. Block spam comments with a honeypot and simple rules, disable XML-RPC, hide user details from the REST API and block problem IP addresses. It is not a malware scanner or firewall, and it doesn’t pretend to be.

Comment Protection

• Master switch to completely disable all comments (form, REST API, XML-RPC, feeds)
• Invisible honeypot field to trap bots
• Minimum comment length enforcement
• Block all links or cap links per comment
• Require login to comment
• Keyword/phrase blocklist

API & REST Hardening

• Disable XML-RPC entirely (removes X-Pingback header too)
• Hide /wp/v2/users endpoints from guests while keeping them available to signed-in users
• Require authentication for all REST API requests
• Optionally disable the REST API completely
• Block author enumeration via /?author=N

Spam Rules

• Per-IP comment rate limiting (configurable max and time window)
• IP address blocklist – blocked IPs receive a 403 on any front-end request
• Rolling activity log (last 200 events)

Privacy

When activity logging is enabled, the plugin stores up to 200 blocked-event entries locally, including IP address, time and reason. Administrators can clear the log or turn logging off. Comment rate limits use temporary counters. No log data is sent to DawsonyWeb or a third-party service. Uninstalling removes the plugin settings, logs and rate-limit transients.