Ayesh Karunaratne

WordPress has a 12-year-old unfixed security vulnerability that it does not properly validate incoming comments.
An attacker can trick both anonymous and logged-in users to post comments on a victim site without them realizing, while using their own credentials.
See this issue for more information: https://core.trac.wordpress.org/ticket/10931
This is a tiny (fewer than 40 effect lines of code) module that adds a secure token to the comment form and validate it before accepting any comment, thus making your comment forms secure as they should\’ve been for all these years!
It provides no UI – just install it, and you are all set!
<ol>
<li>This plugin adds a secret cryptographically-secure token to the comment form. This is a unique value and is computationally impractical to guess it.</li>
<li>Upon comment submission, the comment is rejected if the secret tokens are not present or computationally invalid.</li>
</ol>

Comment Form CSRF Protection

Prevent Cross-Site Request Forgery attacks on your comments form.

This plugin adds the “SameSite” cookie flag to WordPress’s authentication cookies. On supported browsers (all current IE, Edge, Chrome, and Firefox), this can effectively prevent all Cross-Site Request Forgery attacks throughout your WordPress site.
SameSite cookie flag support was added to PHP on version 7.3, but this plugin ships with a workaround to support all PHP versions WordPress supports.
There is no administrative UI provided: Activate this plugin, and you are all set!
You can configure the SameSite flag value from your WordPress configuration file. You cna pick a value from <code>Lax</code> (default), <code>Strict</code>, or <code>None</code>. You can read about <a href="https://php.watch/articles/PHP-Samesite-cookies" rel="nofollow ugc">SameSite cookies here</a>.
To configure the <code>SameSite</code> flag value, edit your WordPress configuration file (<code>wp-config.php</code>), and add the following lines right above <code>/** Sets up WordPress vars and included files. */</code>.
<pre><code>define( 'WP_SAMESITE_COOKIE', 'Lax' ); // Pick from 'Lax', 'Strict', or 'None'.
</code></pre>
Note that only the authentication cookies are affected. Regular cookies that your installed plugins set will not be affected, nor provide any meaningful value with <code>SameSite</code> flags.

SameSite Cookies

Wasted two days on this

I don't know why the Author created this plugin, It does not work, please remove it from the plugin library

The plugin doesn't work

CSRF-protection for authentication cookies. When enabled, this plugin makes sure the "SameSite" flag is set in authentication cookies.

Comment Form CSRF Protection vs SameSite Cookies