Cookies for Comments
This plugin adds a stylesheet or image to your blog’s html source code. When a browser loads that stylesheet or image a cookie is dropped. If that user then leaves a comment the cookie is checked. If it doesn’t exist…
Use with caution
Cookies for Comments works, but test it on a staging site before relying on it in 2026. It runs on 10K+ sites, is rated 4.9/5 and was last updated 7 years ago, and scores 42/100 on our health check.
- Proven at scale on 10K+ active sites
- No update in 7 years
- Only tested up to WordPress 5.2 (latest is 7.1)
How does it stack up?
Side-by-side on installs, updates, ratings & support
![Disable Comments – Remove Comments & Stop Spam [Multi-Site Support]](https://ps.w.org/disable-comments/assets/icon-256x256.png?rev=2509854){kind=icon}
Daily downloads
Download spikes usually follow a new release — each site that auto-updates counts as a download.
Rankings
Where Cookies for Comments stands todayWordPress.org search rankings
Live position in the plugin search, top 100| Keyword | Position |
|---|---|
| comments | >100 |
| cookies | >100 |
| spam | >100 |
Version adoption
Share of active sites per release.
Rating breakdown
★★★★★★★★★★ 4.9 from 18 reviews
About Cookies for Comments
From the official readme · v0.5.5Description
This plugin adds a stylesheet or image to your blog’s html source code. When a browser loads that stylesheet or image a cookie is dropped. If that user then leaves a comment the cookie is checked. If it doesn’t exist the comment is marked as spam.
The plugin can also check how long it took a user to enter a comment. If it’s too fast it’s probably a spam bot. How fast can a legitimate user enter their name, email, web address and enter a well thought out comment?
For the adventurous, add these lines to your .htaccess and it will block spam attempts before they ever get to WordPress. Replace the Xs with the cookie that was set in your browser after viewing your blog. You can also find the cookie value by examining the page source code and looking for “css.php?k=XXXXXXXXXXXXXXXXXXX”. Make sure the lines go above the standard WordPress rules.
RewriteCond %{HTTP_COOKIE} !^.*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.*$
RewriteRule ^wp-comments-post.php - [F,L]
If you use WordPress MU, replace wp-comments-post.php above with wp-signup.php to block spam signups.
RewriteCond %{HTTP_COOKIE} !^.*XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.*$
RewriteRule ^wp-signup.php - [F,L]
Installation
Copy into your plugins folder and activate. If you are using a caching plugin such as WP Super Cache make sure you clear the cache after enabling this plugin.
Changelog
Cookie key name sanitized before the cookie is set.
0.5.5
- Sanitize the cookie key before setting it. Props Matt Cutts and @planetzuda
0.5.4
- Added a rejection message for when people trip over the cookie protection.
- Plugin requires WordPress 3.1+ now.
0.5.2
- Use an image to deliver cookie as well as stylesheet.
- Don’t load WordPress to set the cookie. Makes pageload much faster!
- Added “time to post comment” to comment notification emails.
- Support for SSL sites.
- If user is logged in don’t check for cookie.
- Speed spammer checks to stop smarter bots and human spammers.
0.5.1
- Generate cfc_key all the time if it’s missing, not just on serving the css html
- Added MU signup form mod_rewrite rules to docs and admin page
- Added Settings page link to plugins page.
- Add explanation text to css file.
- Add docs on how to use CFC to protect the MU signup form
- Show htaccess rules on admin page.
- Don’t let wp-super-cache cache this page.
- Store cfc_key in sitemeta for WordPress MU sites
- Added mod_rewrite rules to block spam comments before they get to WordPress
For developers
Is this your plugin? Show off the numbers.
Add a live badge to your site, docs or GitHub README. It updates on its own — no account needed.
Best Cookies for Comments alternatives
All comments plugins →
FAQ
Cookies for Comments: quick answers
Straight answers, pulled from live WordPress.org data.
Live data from WordPress.org · checked Sep 27, 2026
Is Cookies for Comments free?
Yes. Cookies for Comments is free to download and use from the official WordPress.org plugin directory.
Is Cookies for Comments safe to use in 2026?
Cookies for Comments works, but test it on a staging site before relying on it in 2026. It runs on 10K+ sites, is rated 4.9/5 and was last updated 7 years ago, and scores 42/100 on our health check.
How many websites use Cookies for Comments?
Cookies for Comments is active on 10K+ WordPress websites and has been downloaded 108,977 times since it launched in March 2008. It was downloaded 442 times in the last 30 days.
Does Cookies for Comments work with WordPress 7.1?
Cookies for Comments is officially tested up to WordPress 5.2.28, while the latest release is 7.1.2. It may still work, but try it on a staging site first.
When was Cookies for Comments last updated?
The latest version, 0.5.5, was released on June 4, 2019 (7 years ago).
Who makes Cookies for Comments?
Cookies for Comments is developed and maintained by Donncha O Caoimh (a11n).
What are the best alternatives to Cookies for Comments?
The most popular alternatives to Cookies for Comments are Akismet Anti-spam: Spam Pro… (5M+ installs), Disable Comments (1M+ installs) and Antispam Bee (700K+ installs).
Powered by PageForge
Want thousands of pages that rank like these? Build them in an afternoon.
This directory runs on the same engine as PageForge. Turn any spreadsheet, CSV or API into thousands of fast, SEO-ready WordPress pages — with schema, internal links and AI-written copy baked in.
- CSV, Google Sheets & API data sources
- AI content, schema & internal links per page
- Works with Elementor, Gutenberg, Yoast & Rank Math
- Free on WordPress.org — no credit card
