Comments

Justflows ships threaded public comments. Drop a Comments block (justflows.comments.thread) on a post or any content and it renders the approved, threaded discussion plus an accessible submission form. Visitors submit at POST /justflows-comments/submit. New comments hold for moderation by default, and approved comments render without ever exposing commenter email addresses or IPs.

Site and per-post policy#

Settings → Discussion sets the site default: comments on or off, hold for moderation, moderator email, allow author links, auto-close after N days, page size, length and reply-depth limits, and the CAPTCHA provider and keys. A per-post Discussion control on the content edit screen overrides the site policy either way.

Spam and abuse controls#

• Same-origin check, per-IP rate limiting, and a honeypot field on every submission.
• Optional CAPTCHA: Cloudflare Turnstile, hCaptcha, Google reCAPTCHA v2, or Google reCAPTCHA v3. The single-use response is verified server-side; v3 also enforces the expected action and a configurable minimum score.
• Bodies are reduced to a small safe formatting whitelist before storage.

Notifications#

The moderator is emailed on each new comment. Commenters can opt into reply notifications and unsubscribe in one click at /justflows-comments/unsubscribe. Timestamps are normalised across database drivers before rendering.

Moderation#

Admin → Comments lists by status with pagination, inline reply and edit, approve, mark as spam, trash, and permanent delete from the trash. Editors and administrators moderate (comments:moderate). GET /api/comments lists by status; PATCH /api/comments bulk-updates approve, spam, or trash.

Extending the rendered thread#

The comments.render filter hook receives the rendered justflows.comments.thread markup plus the threaded PublicComment[] and the form and policy state (CommentsBlockRenderContext) and can restyle or fully replace the HTML. The submission endpoint, comments table, and moderation API are unchanged. See Hooks.