Andrew Norcross

Grant Hutchinson

Comment Blacklist Manager retrieves a list of terms from a remote source and updates the <code>disallowed_keys</code> setting in WordPress. The plugin will automatically fetch a list of terms on a regular schedule and update the contents of the “Disallowed Comment Keys” field. Terms added manually via the “Local Blacklist” field will be retained during the scheduled updates. Terms added manually to the “Excluded Terms” field will be removed from the list.
The default list of terms is fetched from a <a href="https://github.com/splorp/wordpress-comment-blacklist/" title="Comment Blacklist for WordPress" rel="nofollow ugc">GitHub</a> repository maintained by <a href="https://splorp.com/" title="Interface considerations. Gadget accumulation. Typography. Scotch." rel="nofollow ugc">Grant Hutchinson</a>.

Comment Blacklist Manager

Does as advertised. I especially liked how you can exclude words from the automated blacklist if they don't suit your website.



Great Little Plugin

Remotely add terms to the WordPress Disallowed Comment Keys field to manage spam.

tornevall

Tornevall Networks DNSBL and FraudBL protection for WordPress. The plugin helps block comment activity, account registrations and other unwanted submissions from addresses flagged by Tornevall Networks DNSBL and FraudBL.
FraudBL is part of the protection layer used by the plugin and is available at <a href="https://www.fraudbl.org/" rel="nofollow ugc">fraudbl.org</a>. For general discovery, broader search terms like fraud, blacklist, comment spam and user registration are usually easier to find than niche technical acronyms alone.
The plugin is intended to provide a lightweight anti-spam and anti-abuse layer for WordPress, with support for local caching to reduce repeated lookups and unnecessary load against blacklist services.
Current admin features include manual DNS lookup tools, self-check tools, visitor statistics, safe IP whitelisting, frontend dry-run support for administrators, Cloudflare Turnstile for comments, DNSBL plus Turnstile protection for new WordPress account registrations, and a separate opt-in Turnstile toggle for the public delisting/removal flow. Tools integration now uses one visible DNSBL / Tools API token field in the plugin UI. The live Check token permissions flow always asks Tools directly, warns clearly when the token exists on the other Tools environment (<code>tools.tornevall.com</code> vs <code>tools.tornevall.net</code>), and reports the effective DNSBL permissions for the configured token. Active admin-owned Tools tokens are shown as having automatic DNSBL access through the same <code>X-Dnsbl-Token</code> transport. The plugin now also warns on the WordPress dashboard and settings page when the current token cannot perform live delete / delist operations yet, with a direct link to the active Tools access page. The token status area shows current add/delete/update capability instead of only saying that a token exists, and delisting-page controls stay read-only until delete / delist permission has been confirmed. Internal delist slug routing now uses a dedicated rewrite/query-var path and refreshes rewrite rules on activation and slug changes to avoid <code>/delist</code> 404 cases. The managed public delist page now runs as a checker-style IP-only flow (checks listing first, then submits delist), while custom shortcode pages still support the broader permission-aware operations. The plugin also ships a shortcode delisting/removal form (<code>[dnsbl_removal_form]</code>) with AJAX backend proxy and optional API dry-run acknowledgement, plus a built-in primary removal-page template that is only activated when the configured token has live delete permission. Advanced CIDR delist now follows the delegated Tools guardrail <code>delete_min_cidr_prefix</code>, so non-admin tokens can be limited to <code>/25</code>..<code>/32</code>, <code>/26</code>..<code>/32</code>, or <code>/32</code> only instead of always exposing <code>/24</code>. Tools-backed DNSBL write/check calls now also include additive site identity metadata so Tools-side delist audits can show which WordPress site submitted the request. The admin UI also now shows a small dismissible reminder with a direct link to the WordPress.org review form.
Report issues and feedback: <a href="https://github.com/Tornevall/tornevall-wp-dnsbl/issues" rel="nofollow ugc">GitHub issues</a> 
Plugin URL: <a href="https://wordpress.org/plugins/tornevall-networks-dnsbl-implementation/" rel="ugc">WordPress.org plugin page</a> 
Documentation: <a href="https://tools.tornevall.net/docs/dnsbl-api" rel="nofollow ugc">DNSBL API documentation</a>
<h4>Support and feedback</h4>
Bug reports and feedback can currently be submitted via <a href="https://github.com/Tornevall/tornevall-wp-dnsbl/issues" rel="nofollow ugc">GitHub issues</a>.
Full Documentation: <a href="https://tools.tornevall.net/docs/dnsbl-api" rel="nofollow ugc">DNSBL API documentation</a>
Translations can be contributed via <a href="https://translate.wordpress.org/projects/wp-plugins/tornevall-networks-dnsbl-implementation" rel="nofollow ugc">translate.wordpress.org</a>.

Tornevall Networks DNSBL Implementation

Tornevall Networks DNSBL implementation with FraudBL support for WordPress

Comment Blacklist Manager vs Tornevall Networks DNSBL Implementation