CommVatar – Custom Avatars, Captcha & Comment Socialiser transforms your WordPress comment section into a thriving social engagement hub. Go beyond the default comment system with custom avatars, activity feeds, gamification badges, and intelligent spam protection.

Core Features

Custom Avatar Uploads — Let users upload and crop their own comment avatars with an integrated image cropper
Comment History Hub — Users can view and navigate all their past comments from a single panel
Role-Based Gamification Badges — Automatic badges for Admins, Moderators, Post Authors, Top Commenters, Most Loved, and New Members
Reddit-Style Voting — Like/Dislike system with IP-based duplicate vote prevention
Top Commenters Widget — Sidebar widget showing your most active community members with medals
Community Moderation — Users can flag inappropriate comments for admin review
Rich Text Editor — Replace the plain textarea with a TinyMCE-powered comment editor
Image Attachments — Allow users to attach images to their comments with a lightbox viewer

Spam Defense Layer

6 CAPTCHA Providers — Math, Word, Google reCAPTCHA v2, reCAPTCHA v3, hCaptcha, Cloudflare Turnstile
Invisible Honeypot Traps — Catch bots without user interaction
Time-Based Traps — Detect suspiciously fast form submissions
AI-Powered NSFW Filter — Sightengine integration blocks explicit image uploads
AJAX-Driven CAPTCHAs — Bypass page caching for always-fresh challenges

WooCommerce Compatible

CAPTCHA protection extends to WooCommerce login, registration, and lost password forms.

Dashboard Analytics

Live spam interception feed with IP tracking
7-day engagement chart (comments vs spam)
Community moderation queue with one-click actions

Third-Party Services

This plugin connects to external third-party services under specific conditions. No data is sent to any external service unless the site administrator explicitly enables the feature and provides API keys. All connections use the WordPress HTTP API.

1. Sightengine — AI Image Moderation

What it does: Scans uploaded avatar and comment attachment images for NSFW, violent, or explicit content using AI models.
When it’s used: Only when the administrator enables “NSFW Image Filter” in plugin settings AND provides Sightengine API credentials.
Data sent: The uploaded image file (binary), API user ID, API secret key.
Service URL: https://api.sightengine.com/1.0/check.json
Provider: Sightengine
Terms of Service: https://sightengine.com/policies/terms
Privacy Policy: https://sightengine.com/policies/privacy

2. Google reCAPTCHA (v2 and v3)

What it does: Protects forms (comments, login, registration, lost password) from spam and abuse using Google’s reCAPTCHA challenge system.
When it’s used: Only when the administrator selects “reCAPTCHA v2” or “reCAPTCHA v3” as the CAPTCHA provider AND provides Google API keys.
Data sent: User interaction token, secret key, client IP address (sent server-side for verification).
Service URLs:
- Widget: https://www.google.com/recaptcha/api.js
- Verification: https://www.google.com/recaptcha/api/siteverify
Provider: Google
Terms of Service: https://policies.google.com/terms
Privacy Policy: https://policies.google.com/privacy

3. Cloudflare Turnstile

What it does: Provides a privacy-focused CAPTCHA alternative to protect forms from bots.
When it’s used: Only when the administrator selects “Turnstile” as the CAPTCHA provider AND provides Cloudflare API keys.
Data sent: User interaction token, secret key (sent server-side for verification).
Service URLs:
- Widget: https://challenges.cloudflare.com/turnstile/v0/api.js
- Verification: https://challenges.cloudflare.com/turnstile/v0/siteverify
Provider: Cloudflare
Terms of Service: https://www.cloudflare.com/terms/
Privacy Policy: https://www.cloudflare.com/privacypolicy/

4. hCaptcha

What it does: Provides a privacy-respecting CAPTCHA service to protect forms from automated abuse.
When it’s used: Only when the administrator selects “hCaptcha” as the CAPTCHA provider AND provides hCaptcha API keys.
Data sent: User interaction token, secret key (sent server-side for verification).
Service URLs:
- Widget: https://hcaptcha.com/1/api.js
- Verification: https://hcaptcha.com/siteverify
Provider: hCaptcha (Intuition Machines, Inc.)
Terms of Service: https://www.hcaptcha.com/terms
Privacy Policy: https://www.hcaptcha.com/privacy