Comments Anywhere

A WordPress plugin for Elementor that lets you place like and comment buttons anywhere inside your content — in loops, inside dynamic templates, and without any page reloads.

Comments Anywhere gives you four native Elementor widgets — Like Icon, Comment Icon, Comment Embed, and Liked Posts — each with a unique ID system, a built-in authentication layer, centralized moderation, and a global design system. Everything runs on your own server. No third-party platforms, no hidden dependencies.

Requirements

Before installing, make sure your environment meets the following minimum versions:

Installation

1. Upload the comments-everywhere folder to /wp-content/plugins/ on your server.

2. In your WordPress dashboard go to Plugins → Installed Plugins and activate Comments Anywhere.

3. On activation, all required database tables are created automatically.

4. Open Comments Anywhere → Settings to configure global behaviour (consent snackbar, moderation, spam filter, etc.).

5. Open any page in Elementor, search for "Like Icon", "Comment Icon", "Comment Embed", or "Liked Posts" in the widget panel, and drag the widget into your layout.

Widgets

Comments Anywhere registers four widgets in the Elementor panel under the Comments Anywhere category. Each widget has a unique ID system that lets you track interactions at the section, post, or individual element level.

Widget ID System

Every widget has a Widget ID field in its Content tab. This ID is the key under which likes and comments are stored. Two widgets with the same ID share the same count and comment thread.

The ID Source setting controls how the ID is resolved:

• Manual — you type the ID directly. Good for single placements.
• Post ID — the current post's ID is used automatically. Ideal for Loop Grid templates so every post in a grid gets its own counter.
• Dynamic Tag — resolves via an Elementor dynamic tag for maximum flexibility.

An optional Namespace prefix lets you group widgets logically (e.g. blog, course) and avoid ID collisions across different content types.

Like Icon Widget

The Like Icon widget renders a toggleable like button. When a visitor clicks it, the like is recorded server-side and the icon animates into its active state without a page reload.

Content Settings

• Widget ID — unique identifier for this like target.
• ID Source — Manual, Post ID, or Dynamic Tag.
• Namespace — optional prefix to group related widgets.
• Tags — comma-separated tags attached to each like event (used in the analytics tag cloud).
• Icon / Active Icon — choose any icon from the Elementor icon library for the default and liked states.
• Show Count — toggle the like counter on or off.
• Count Position — place the number before or after the icon.
• Alignment — left, center, or right.

Authentication

The Login Required toggle (per widget) enforces that a visitor must be logged in before their like is saved. This check is enforced server-side — disabling JavaScript does not bypass it. There is also a global equivalent setting under Comments Anywhere → Settings.

Consent Settings

• Enable Consent Snackbar — show a GDPR opt-in bar before the first interaction.
• Default Language — en, de, or es.
• Show Language Switcher — lets the visitor change the snackbar language.

Style

The Style tab gives full control over the icon's appearance across four states: Normal, Hover, Liked, and Liked Hover. Each state has individual color, background color, and border color controls. Additional options include icon shape (square, rounded, circle), size, and wrapper scale factor.

Comment Icon Widget

The Comment Icon widget renders a comment button. When clicked, a lightweight modal opens at the click point without reloading the page. On mobile devices the modal expands to full screen for a better reading experience.

Content Settings

• Widget ID / ID Source / Namespace — same as the Like Icon widget.
• Icon — choose any icon for the comment button.
• Show Comment Count — display the number of approved comments next to the icon.
• Count Position — before or after the icon.
• Alignment — left, center, or right.

Dialog Settings

• Dialog Title — heading shown at the top of the modal.
• Textarea Placeholder — hint text in the comment input field.
• Submit Button Label — text of the submit button.
• Visibility Label and options — customize the labels for "Everyone", "Logged-in users", and "Only me".
• No Comments Text — empty state message.
• Reply Button Label — text for the reply action on individual comments.

Comment Features

• Threaded replies — visitors can reply directly to individual comments.
• Visibility per comment — each commenter chooses between Public, Logged-in only, or Only me.
• Edit window — authors can edit their own comments within 15 minutes of posting.
• Delete — authors can delete their own comments.
• Admin replies with automatic email notification to the original commenter.
• Optional moderation pipeline — new comments are held for approval before appearing publicly.

Style

The Style tab mirrors the Like Icon widget with Normal, Hover, and Active state controls plus shape, size, and spacing settings.

Comment Embed Widget

The Comment Embed widget renders the full comment section directly in the page layout — no button click required. It is the right choice whenever you want comments visible immediately, for example at the bottom of a blog post.

Content Settings

All the same content options as the Comment Icon widget. Additionally:

• Show Title — toggle a section heading above the comments.
• Title — custom heading text.
• Show Comment Count in Title — append the count to the heading automatically.

Style

• Container — background, padding, and border radius of the whole widget.
• Title — color and bottom spacing of the heading.
• Comment Items — individual comment row styling.

Liked Posts Widget

The Liked Posts widget shows a list of posts the currently logged-in visitor has liked. It is designed to work with Elementor's Loop Grid feature.

Loop Grid Integration

To use it as a dynamic data source for a Loop Grid:

1. Add an Elementor Loop Grid widget to your page.

2. In the Loop Grid's Query settings, set the source to Custom Query.

3. Enter the Query ID: ce_liked_posts

4. The loop will automatically render only the posts liked by the current user.

Content Settings

• Post Type — filter to a specific post type.
• Number of Items — how many liked posts to display.
• Show Thumbnail — display the post's featured image.
• Show Liked Date — show when the post was liked.
• Show Excerpt — include the post excerpt.
• Empty State Message — text shown when the user has no likes yet.

Style Settings

Controls for thumbnail dimensions and border radius, title color and hover color, date/meta color, item gap, item padding, and an optional divider between items.

User Accounts

Comments Anywhere runs its own lightweight authentication layer alongside WordPress's native user system. There are two types of user account:

WordPress Users

Any visitor already logged in to WordPress is automatically recognized and a corresponding CE account is created on their first interaction. No extra registration is needed.

CE Guest Accounts

Visitors who are not WordPress users can register a CE Guest Account with a username, email address, and password. These accounts are stored in the plugin's own database table (wp_ce_guest_users) and are entirely separate from wp_users.

• Email verification — a confirmation link is sent on registration, valid for 48 hours.
• Password requirements — minimum 8 characters, must include at least one letter and one number or special character.
• Session cookies — HTTPOnly, Secure, SameSite=Lax, valid for 30 days.
• Rate limiting — maximum 10 login attempts per 5 minutes per IP address.
• Account deletion — users can delete their own account and all associated data at any time (GDPR Article 17).

Auth Flows

Registration

The auth modal opens automatically when a visitor attempts to like or comment and a login is required. After registering, a verification email is sent. The visitor can resend the email from the modal if needed.

Login

Registered visitors enter their email and password. Sessions are stored as SHA-256-hashed tokens.

Password Reset

A "Forgot password?" link in the login view triggers a reset email containing a one-time token valid for 1 hour. The visitor follows the link, enters a new password, and is logged in.

Account Deletion

From the account modal, a logged-in CE Guest user can permanently delete their account. All likes, comments, and identity records associated with that account are removed from the database.

Settings

Found under Comments Anywhere → Settings in the WordPress admin menu.

General

• Consent Snackbar — enable or disable the global opt-in bar.
• Default Language — sets the default language for the snackbar (en, de, es).
• Auto-Cleanup — automatically delete anonymous interaction data older than 1 year.
• Exclude Admins — exclude administrator accounts from like and engagement tracking.
• Require Login for Likes (Global) — enforced server-side across all widgets site-wide.
• Allow Anonymous Comments — allow visitors to post comments without an account.

Comments

• Comment Moderation — hold all new comments for admin approval before they appear publicly.
• Email Notifications — send email alerts on comment replies and admin responses.

Spam

• Keyword Filter — define a list of blocked words; comments containing them are flagged automatically.
• Akismet Integration — connect an Akismet API key for automated spam detection.

Design System

Found under Comments Anywhere → Design.

All modals, dialogs, auth forms, and consent snackbars share a single set of CSS custom properties injected on :root. This means you configure the look once and every element of the plugin follows automatically.

• Light / Dark Mode — toggle between a light and dark colour scheme for all plugin UI.
• Accent Color — a color picker sets the primary action color used for buttons, active states, and highlights.
• Live Preview — the admin page shows a live preview of the dialog so you can see changes before saving.

Moderation

Found under Comments Anywhere → Comments.

All comments from all pages and all widgets across your entire site are collected in a single moderation view. You never need to visit individual pages to manage comments.

Available Actions

• Approve — publish a pending comment.
• Reply — post an admin reply; the original commenter receives an email notification automatically.
• Delete — permanently remove a comment.
• Mark as Spam — flag a comment and optionally feed it to Akismet.

Filters

Filter the comment list by status: All, Pending, or Approved.

Analytics

Found under Comments Anywhere → Statistics.

• Total likes, likes in the last 7 days, and likes in the last 30 days.
• Most-liked post across the entire site.
• Total user count broken down by registered and anonymous.
• Tag cloud of the most frequently used like tags.
• Activity table showing IP, user, total likes, and last action timestamp.
• Click any user row to open a modal listing all posts that user has liked.

User Management

Found under Comments Anywhere → Users.

A table of all CE Guest Accounts registered on your site. For each user you can:

• Activate — manually verify a user account.
• Suspend — block the account from further interactions.
• Delete — permanently remove the account and all associated data.
• View Comments — see all comments posted by that user.

Consent & GDPR

Consent Snackbar

Before any like or comment is recorded for a non-authenticated visitor, an opt-in consent snackbar is shown. The visitor must actively accept before any data is stored. The consent decision is saved in a cookie for 1 year.

Available languages: English, German, Spanish. You can enable a language switcher so visitors can change the language of the snackbar.

Anonymous Identities

Visitors who have not registered but have given consent are tracked by an anonymous cookie-based ID — no personally identifiable information is stored. These anonymous records are automatically deleted after 1 year if the Auto-Cleanup setting is enabled.

Right to Erasure (Art. 17)

Registered CE Guest users can delete their own account and all associated data directly from the account modal on the front end. Admins can delete any guest account from the Users admin page.

Data Location

All data is stored in your own WordPress database. Nothing is sent to external servers.

REST API

All endpoints are prefixed with /wp-json/comments-everywhere/v1/.

Likes

Comments

Authentication

Consent

Database Schema

All tables use the WordPress table prefix (default wp_). Tables are created automatically on plugin activation and removed cleanly on uninstallation.

Security

Input & Output

• All user input is sanitized with sanitize_text_field(), sanitize_textarea_field(), absint(), and esc_url_raw().
• All HTML output is escaped with esc_html(), esc_attr(), and esc_url().
• All database queries use $wpdb->prepare() — no raw SQL with user input.

Requests & Sessions

• All write requests require a valid WordPress Nonce (X-WP-Nonce header).
• Session tokens are stored as SHA-256 hashes — never plain text.
• Session cookies are set with HTTPOnly, Secure, and SameSite=Lax.

Rate Limiting

• Login attempts: maximum 10 per 5 minutes per IP.
• Password reset requests, like toggles, and comment submissions are all individually rate-limited.
• Rate limiting uses REMOTE_ADDR only — no header spoofing via X-Forwarded-For.

Flood Protection

• Public read-only GET endpoints do not create identity records in the database, preventing anonymous DB flooding.

Passwords

• Minimum 8 characters with at least one letter and one number or special character.
• Password reset tokens are SHA-256-hashed and expire after 1 hour.

Accessibility

• All interactive elements have ARIA labels.
• Full keyboard navigation — Tab to move between elements, Enter to activate, Escape to close modals.
• High-contrast mode is supported via CSS.
• prefers-reduced-motion is respected — animations are disabled for users who prefer it.
• Visible focus indicators on all interactive elements.

Browser Support

Current versions of Chrome, Firefox, Safari, and Edge on desktop. Mobile: iOS Safari and Chrome for Android.

Changelog