# How to Automate WordPress Comment Moderation using the API

- Tool: API Automations
- Difficulty: Beginner
- Fix time: 45 minutes
- Compatibility: WordPress 5.6+, WooCommerce optional
- Last updated: May 2026

## TL;DR

Fetch pending comments with GET /wp/v2/comments?status=hold, run each through a keyword blocklist or AI spam check, then update the status to 'approved', 'spam', or 'trash' via PUT /wp/v2/comments/{id}. Requires Application Password belonging to an Editor or Administrator — the moderate_comments capability is mandatory. WordPress has no comment webhooks, so schedule this as a cron job every 15 minutes.

## Best practices

- Never auto-trash comments — move to spam status first so Akismet and other plugins can learn from the signal, then let the 30-day cleanup process handle deletion
- Keep borderline comments (short text with link, new commenter) in 'hold' status for manual review rather than auto-approving or auto-trashing
- Add 100ms delay between individual comment update requests to avoid triggering managed host WAF throttles
- Log all moderation decisions with timestamp, comment ID, author email, and the decision reason for compliance and audit trails
- Test your keyword blocklist monthly — spam patterns evolve, and overly broad patterns (e.g., 'free') will catch legitimate comments
- Use a dedicated Editor account for the automation with its own Application Password — not your main admin credentials
- Schedule moderation runs during low-traffic hours (2–5 AM server time) to minimize impact on host throttle budgets

## Frequently asked questions

### Why am I getting 403 when I try to update comment status?

Your Application Password belongs to a user without the moderate_comments capability. Only Editor and Administrator roles can moderate comments. Subscriber and Author roles return 403 rest_forbidden. Generate a new Application Password from an Editor or Admin account.

### What's the difference between 'spam' and 'trash' status for comments?

Spam is the correct status for junk comments — it feeds spam-learning plugins (like Akismet) and keeps the comment visible in the Spam queue for plugin analysis. Trash is for legitimate comments you want to delete — they're recoverable for 30 days then purged. Always use spam for automated moderation results, not trash.

### Does WordPress have comment webhooks so I don't need to poll?

WordPress core has no webhook system for comments. You must poll with GET /wp/v2/comments?status=hold on a schedule (every 15 minutes works well for most sites). WooCommerce adds webhook support for orders, but that doesn't extend to core WordPress comments.

### How do I get comments from a specific post only?

Add the post parameter: GET /wp/v2/comments?status=hold&post=123. Replace 123 with the post ID. This is efficient when you only need to moderate comments on a specific high-traffic post after publishing.

### What is the maximum number of comments I can fetch per request?

WordPress allows up to per_page=100 per request. Check the X-WP-TotalPages response header to determine if you need additional pages. A site with 350 pending comments requires 4 requests (100+100+100+50). The default is per_page=10 if you don't specify.

### Can I moderate comments on a WordPress.com hosted site using Application Passwords?

WordPress.com uses its own OAuth2 API (developer.wordpress.com) rather than Application Passwords. The endpoints are the same (/wp/v2/comments) but authentication differs. For self-hosted WordPress.org sites on managed hosts (WP Engine, Kinsta, etc.), Application Passwords work as documented.

### RapidDev built a comment moderation pipeline — what's a realistic time to implement this?

A basic keyword-filter moderation script takes about 45 minutes to build and deploy. The RapidDev team can help with more advanced implementations that combine keyword filtering, AI spam scoring, and Slack notifications for manual review — typically a 2-3 hour project depending on complexity.

---

Source: https://www.rapidevelopers.com/api-automations/how-to-automate-wordpress-comment-moderation-using-the-api
© RapidDev — https://www.rapidevelopers.com/api-automations/how-to-automate-wordpress-comment-moderation-using-the-api