- CSRF — a session token checked on every POST request
- Honeypot — a hidden
websitefield; if it is filled in, the request is rejected - Rate limiting — a sliding window: X comments per Y seconds (configurable)
- IP blocking — an exact address or CIDR; in silent mode the IP gets a fake success instead of an error
- Stop words — three modes: to moderation, reject, spam
- Forbidden names — names guests may not use
- Email protection — if a guest enters the email of a registered user, the form suggests logging in
- CAPTCHA — PHP GD generates a 240×70 px image with 6 random digits; the user is randomly asked to enter the first or the last 3; the correct answer is kept in the session; the reply form does not ask for the CAPTCHA again
Stop words and blocked IPs are managed on the “Stop words” and “IP blocks” tabs of the component; the settings are in the “Security” section of the system settings.