Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.

Closed 5 years ago.

Native WP comments system requires only display name and email to leave a comment. So if I know the email of a "well-known" person, I can leave a comment using his/her identity (and gravatar also). Is it good practice?

Thanks for any opinions!

Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.

Closed 5 years ago.

Native WP comments system requires only display name and email to leave a comment. So if I know the email of a "well-known" person, I can leave a comment using his/her identity (and gravatar also). Is it good practice?

Thanks for any opinions!

• comments

• 2 A lot of people use WP comments, and you can require an account be registered to provide email verification. Can you be more specific about your concern? Safe can mean different things to different people – Tom J Nowell ♦ Commented May 21, 2019 at 17:15
• Your question as stated is too broad and is primarily opinion. As Tom noted, "safe" can mean different things to different people. – butlerblog Commented May 21, 2019 at 17:25

3 Answers 3

WordPress default settings are to allow anyone to comment as long as they leave a name and email. Emails aren't verified, so you could use someone else's email and gravatar and the comment would be published.

Best practice is to verify the email address of the user making the comment. In WordPress core functionality, this requires users register for an account in order to comment.

Absolutely Not, that's why either allow only registered users to leave comments or you can build your custom function using wp_set_comment_status() and wp_mail(), to show comments only after verification via email.

Update:

In case, I have disabled both the options in "Before a comment appears" settings, which in most of the cases may be required.

In this case, when an unauthenticated or non-logged in commentator leave a comment using Name and Email fields, the commentator can use any email, as there is no additional verification available for this until we do it manually or use any third-party solution.

The commentator may use Name and Email of any popular blogger/person, and if the same email is registered with gravatar then it will fetch the gravatar profile image, this may mislead to other users, and anyone can steal the gravatar identity of anyone.

The native WordPress commenting system, without checks of any kind, is very likely a bad idea. However, the system does include the ability to require users to sign up for an account before being able to comment. That combined with a registered version of the Akismet plugin and WordFence (or some other security plugin) will keep public spam to a minimum.