Comments

Justflows ships threaded public comments. Drop a Comments block (justflows.comments.thread) on a post or any content and it renders the approved, threaded discussion plus an accessible submission form. Visitors submit at POST /justflows-comments/submit. New comments hold for moderation by default, and approved comments render without ever exposing commenter email addresses or IPs.

Site and per-post policy#

Settings → Discussion sets the site default: comments on or off, hold for moderation, moderator email, allow author links, auto-close after N days, page size, length and reply-depth limits, and the CAPTCHA provider and keys. A per-post Discussion control on the content edit screen overrides the site policy either way.

Spam and abuse controls#

• Same-origin check, per-IP rate limiting, and a honeypot field on every submission.
• Optional CAPTCHA: Cloudflare Turnstile, hCaptcha, Google reCAPTCHA v2, or Google reCAPTCHA v3. The single-use response is verified server-side; v3 also enforces the expected action and a configurable minimum score.
• Bodies are reduced to a small safe formatting whitelist before storage.

Settings → Discussion → Spam protection adds a local heuristic scorer — links, keywords, repeated text, disposable email domains, a render-age token, and terms learned from "mark as spam" — that auto-approves, holds, or auto-marks spam per configurable score thresholds (defaults: hold at 40, reject at 75). Signed-in commenters get their own rate-limit bucket alongside the per-IP one, and a "hold a first-time commenter" option and an "auto-approve a returning commenter" option tune moderation further.

• Author-email, domain, IP, and phrase block and allow lists — allow always beats block — with one-click "Block email / domain / IP" actions right from the moderation queue.
• Spam terms the moderation queue learns automatically from "mark as spam", alongside terms an administrator adds by hand.
• A configurable retention window purges spam comments automatically; every rule change and score decision is written to the audit log.
• The comments.spamBackend SDK filter lets a plugin attach an external spam-scoring service (Akismet-style) without becoming a hard dependency — the host's own thresholds always apply on top.

Notifications#

The moderator is emailed on each new comment. Commenters can opt into reply notifications and unsubscribe in one click at /justflows-comments/unsubscribe. Timestamps are normalised across database drivers before rendering.

Moderation#

Admin → Comments lists by status with pagination, inline reply and edit, approve, mark as spam, trash, and permanent delete from the trash. Editors and administrators moderate (comments:moderate). GET /api/comments lists by status; PATCH /api/comments bulk-updates approve, spam, or trash.

Extending the rendered thread#

The comments.render filter hook receives the rendered justflows.comments.thread markup plus the threaded PublicComment[] and the form and policy state (CommentsBlockRenderContext) and can restyle or fully replace the HTML. The submission endpoint, comments table, and moderation API are unchanged. See Hooks. Plugins hear about new comments through the comments.created action, which runs when a comment is stored as pending or approved and carries ids and the status, never the email, IP address, or text. Elsa Workflows uses it to start a workflow per page.