Anonymous commenting system (plugin) for WordPress — no passwords or registration required

What readers see

Readers sign in in three steps, with nothing else to remember.

1. They enter their email and select a single consent checkbox, which links to the privacy policy.
2. They receive a six-character code by email (letters and numbers, for example ABC123) and enter it.
3. They write a comment and click “Submit”.

There is no password at all: nothing to forget, recover, or leak. After the first sign-in, the site remembers the reader for 30 days, so posting the next comment takes just one click. If the email does not arrive within a few minutes, the form suggests checking the “Spam” and “Promotions” folders, and the “Send again” button becomes available after one minute. If the email address was mistyped, readers can click “← Change email”.

While the session is starting, the page does not flicker: the login form appears only for users who are not yet logged in.

Anonymity and privacy

To other readers, commenters remain anonymous: only their name and comment text are publicly visible; their email address is never displayed. This is stated directly below the form. We do not provide or promise complete anonymity from the site owner: an email address is required to send the code and distinguish real people from spam. Everything else is designed to collect as little information about the person as possible.

• No third-party requests. No Google Fonts, no Gravatar, no trackers. The font comes from the site's theme, and the avatar is generated locally—a letter on a neutral background. The address hash is included in neither the HTML nor server responses.
• IP addresses and User-Agent strings are not stored.
• One cookie. dc_session is set only after the code is entered; it is a technical login cookie (HttpOnly, SameSite=Lax, Secure over HTTPS).
• Consent is recorded on the server: when and which version of the terms the person agreed to. This cannot be bypassed through the browser.
• Everything that's yours—all in one place. In their account, users can change their name, download all their data as a JSON file, or click “Delete Account and Data.” This will erase their profile, comments and replies, likes, sessions, and codes.
• Deleting your own comment is permanent. It isn't “hidden”—it's erased from the database.
• Unsubscribe from emails with one click, and the unsubscribe list stores a hash rather than the address itself.

One detail worth knowing: when you first sign in, your display name is taken from the part of your email address before the “@”. If your email address looks like ivan.petrov@…, it's best to go straight to “My Data” and replace it with a username—then the name shown under your text will be one you chose yourself.

Convenience and comfort

Everything you need for a good conversation, and nothing you don't. The design is minimalist: thin lines instead of cards, black-and-white buttons, with emphasis only on focus and likes.

• Replies. A single level of nesting, as with most media sites: threads don't turn into an endless staircase and remain easy to read on a phone.
• Likes. Guests can see the count, while signed-in users can like or unlike a comment.
• Reply notifications. When someone replies to your comment, you'll receive an email with a link to the discussion. You can unsubscribe with one click.
• 20 items loaded at a time. Long discussions aren't loaded all at once: there's a “Load more” button for the rest.
• Light and dark themes. Colors and fonts are inherited from the site's theme and switch along with it. To adapt the plugin to a different design, simply change a couple of variables in base.css.
• Accessibility. Screen reader labels, ARIA attributes, and inline error and status messages within the form—no pop-ups.
• Multilingual support. If the website has the SDWSKI.com Translate plugin installed, comments are separated by language: the Russian version displays comments in Russian, while the Lithuanian version displays comments in Lithuanian. Links in emails lead to the appropriate language version of the post. Without this plugin, everything works as usual.

There are also additional shortcodes for a standalone login form, user account, latest comments across the site, and comments by the current reader.

How the plugin works

The page remains static, while comments are handled separately, so the plugin does not interfere with caching.

The cache serves the page as usual, then a script in the browser requests from admin-ajax.php the session and feed. This URL is standard for WordPress and always bypasses the cache, so there is no need to adjust LiteSpeed Cache or WP Rocket.

• Sign-in. The 6-character code is valid for 15 minutes, with 5 entry attempts allowed; a new code can be requested no more than once per minute. The session uses a random token stored in HttpOnly-cookie and in the database for 30 days. Expired sessions and codes are cleared by a daily WP-Cron task.
• Security. All SQL queries go through $wpdb->prepare(), all HTML is stripped from comment text, and the nonce is verified on every POST request.
• Cache. Lists and counters are cached separately for each language and invalidated whenever a new comment is posted. LiteSpeed Cache is notified too.
• A database of its own. Readers and comments are stored in five custom tables, not in wp_comments or among WordPress users. This means readers are kept completely separate from the site's user accounts.

Who it's for

The plugin is useful on sites where comments are part of a conversation with readers, rather than a breeding ground for spam and arguments.

• For blog and online magazine authors on WordPress, who are tired of the “Name, Email, Website” fields and generic avatar images.
• For projects in Europe, where GDPR compliance and a clean database matter: consent, data export, and data deletion are built in, including through the WordPress personal data export and erasure tools.
• For multilingual websites, where each language version needs to have a life of its own.
• For those using aggressive caching (LiteSpeed Cache, WP Rocket): pages remain static, while comments are loaded separately.
• For those who want independence: no third-party services or subscriptions—everything is stored in your database.

Site owners also get plenty of useful features: moderation in the admin area (new comments can be reviewed before publication), a user list with blocking controls, author badges, language filters, and a trash folder where comments deleted by a moderator are kept for 30 days before being automatically erased. Codes are sent through your standard WordPress email system, so it is worth configuring SMTP: the code needs to arrive quickly.

Installation and setup

Installation takes just a couple of minutes: upload the folder sdwski-comments in /wp-content/plugins/, activate it in the admin panel, and the database tables will be created automatically. To update, simply replace the files, and the database will be upgraded to the required version.

By default, the comments section appears below every post, while the native WordPress comments are disabled. Under “Settings → SDWSKi Comments,” you can enable pre-moderation, choose where the privacy policy, terms and conditions, user account, and security page links should point, and, if automatic placement is not needed, disable it and insert the shortcode wherever you want. The plugin automatically adds the privacy policy text to the WordPress guide.

Want a commenting system like this on your website? Send me a message.

You can also see how SDWSKi Comments works on my blog or on the men's magazine Doberman Media.