FAIR

Federated and Independent Repositories

Soulsites Comments Anywhere

Plugin Banner

Soulsites Comments Anywhere

by Christian Wedel

Download
Description

Soulsites Comments Anywhere provides a like and comment system as native Elementor widgets – self-hosted, with a built-in consent snackbar and data-deletion controls. Interaction data is stored on your WordPress database. Freemius handles optional licensing and usage opt-in; Akismet is contacted only when its separate integration is enabled (see “Third Party Services” below).

This plugin gives you the technical building blocks (consent snackbar, self-hosted storage, data deletion, retention limits) that GDPR-style privacy regulations typically require, but it cannot make your site “GDPR-compliant” by itself: this is not legal advice, and whether your specific use is compliant also depends on your privacy policy, your legal basis for processing, and how you configure and operate the plugin. Consult a legal professional for your specific situation.

Core Features

4 Elementor Widgets

  • Like Icon Widget (Free) – Customizable like icon with counter, animated state change and optional login requirement. Works in Elementor Loop templates.
  • Comment Icon Widget (Free, Pro options) – Floating comment dialog with threaded replies and public, logged-in-only or private visibility. Moderation requires Pro.
  • Comment Embed Widget (Free, Pro options) – Embedded comment section, always visible.
  • Liked Posts Widget (Free) – Shows the posts liked by the current user; compatible with Elementor Loop Grid (Query ID: scany_liked_posts).

Own Authentication System

  • WordPress users are automatically detected and linked.
  • CE Guest Accounts: registration with email verification, login, password reset.
  • Secure session cookies (HTTPOnly, Secure, SameSite=Lax).
  • Rate limiting for login, registration and comments.

Privacy Controls

  • Opt-in consent snackbar before the first like/comment (EN/DE/ES, auto-detects WordPress language); can be disabled in Settings.
  • Self-hosted – all likes, comments and visitor data stay on your own server.
  • Users can delete their own account themselves (comment authorship removed, likes and reactions deleted).
  • Auto-cleanup of anonymous browser identifiers with no remaining likes/comments after 1 year.
  • Integrates with WordPress’s own Privacy Policy Guide and Export/Erase Personal Data tools.

Admin Dashboard

  • Statistics (likes, trends, tag cloud, activity table) — Pro
  • Comment moderation (approve, reply, delete, mark as spam) — Pro
  • User management (activate, suspend, delete CE Guest Accounts)
  • Global design system and per-widget design overrides — Free
  • Email notifications on comment replies — Pro

Security

  • All SQL queries via $wpdb->prepare() (SQL injection protection)
  • Nonce verification for all write REST endpoints
  • Output escaping: esc_html(), esc_attr(), esc_url()
  • Session tokens stored as SHA-256 hash in the database
  • Rate limiting against brute force and spam
  • Honeypot field for bot detection
  • Altcha Proof-of-Work CAPTCHA (self-hosted, no external requests)

Third Party Services

This plugin uses Freemius for optional usage tracking and paid-license management. Free features work when Skip is selected. Only after explicit opt-in or paid-license activation, Freemius may receive:

  • WordPress account name and email address
  • Site URL/title/language, server IP, and WordPress/PHP versions
  • Plugin/SDK versions and activation state
  • Installed plugin/theme names, versions and state if that permission is enabled
  • Paid-license status

No comments, likes, or personal visitor data are ever transmitted to Freemius. This connection is subject to the Freemius Privacy Policy and Freemius Terms of Service.

Optionally, if the site owner installs and activates the separate Akismet plugin, comment content, IP address, user agent, referrer and site URL are sent to Akismet for spam checking, subject to the Akismet Privacy Policy. This is disabled by default.

Source Code

assets/js/altcha.min.js is the minified browser build of the third-party [ALTCHA](https://altcha.org) Proof-of-Work CAPTCHA widget (MIT license), used unmodified.
  • Package: altcha v3.1.0 (npm)
  • Source: https://github.com/altcha-org/altcha/tree/7fd2468bdf60eb13670d580e80e1d70dd72909fe

  • License and build instructions: assets/js/ALTCHA-LICENSE.txt in this plugin’s own source

    assets/js/altcha-worker.js is this plugin’s own code (not third-party), a small Web Worker that runs ALTCHA’s Proof-of-Work solver off the main thread.

  1. Upload the plugin folder to /wp-content/plugins/soulsites-comments-anywhere/.
  2. Activate the plugin in the WordPress backend.
  3. Elementor must be installed and activated.
  4. Database tables are automatically created on activation.
  5. Configure under Soulsites Comments Anywhere Settings.
Do I need Elementor Pro?

No. The plugin works with the free version of Elementor. Elementor Pro is only required for Loop Grid (Liked Posts Widget).

Does this plugin make my site GDPR-compliant?

No plugin can guarantee legal compliance on its own – that depends on your own privacy policy, legal basis, and configuration, and this is not legal advice. What the plugin does: all data is stored on your own server, a consent snackbar appears before the first like/comment (and can be disabled in Settings), anonymous browser identifiers with no remaining likes/comments are automatically deleted after 1 year, and users can delete their own account (comment authorship removed, likes and reactions deleted). It also integrates with WordPress’s own privacy tools (Settings Privacy Policy Guide, and Tools Export/Erase Personal Data). Consult a legal professional to assess your specific situation.

Does the plugin work with caching?

The REST API is executed server-side and is not affected by page caching. The like status and comments are updated client-side after page load via the REST API.

How does spam protection work?

The Free plan includes a built-in keyword filter and self-hosted Altcha Proof-of-Work CAPTCHA for registrations and anonymous comments. Akismet integration is available in Pro when Akismet is installed and configured.

Is all data deleted on uninstall?

Yes. When deleting the plugin, all plugin tables, options, transients and scheduled cron events are cleanly removed from the database via the Freemius after_uninstall hook.

What languages are supported?

The plugin defaults to English. A German translation (de_DE) is included. The consent snackbar also supports Spanish. The language is auto-detected from the WordPress site language setting, or can be overridden in Settings.

1.1.13

  • Fixed activation so all six database tables are created (dbDelta-compatible CREATE TABLE statements).
  • Prefixed the remaining admin menu slug and the Premium modal script handle.
  • Admin assets are enqueued on the plugin’s own screens only.
  • Inline admin JavaScript is built in dedicated functions, so every output buffer opens and closes in the same scope.

1.1.12

  • Fixed the remaining Freemius global and hook prefixes reported by Plugin Check.

1.1.11

  • Enabled all bundled design controls in Free; removed the public account-status lookup.
  • Introduced unique scany_/SCANY_ prefixes with non-destructive legacy compatibility.
  • Removed bundled plugin PO/MO catalogs; WordPress.org language packs handle translations.

1.1.10

  • Renamed to Soulsites Comments Anywhere; WordPress.org slug and text domain are now soulsites-comments-anywhere. Existing data and widget IDs remain unchanged.
  • Comment visibility and the Liked Posts widget/query integration are fully available in Free without a license.
  • Fixed WordPress.org review findings for asset enqueueing, SVG escaping, JSON encoding, SDK global/action prefixes and REST nonce validation.
  • Corrected author/contributor metadata and updated bundled German translations, packaging and build checks.

1.1.8

  • Build: fixed remaining WordPress.org Plugin Check findings surfaced by the actual generated Free package (escaping, translator comments, a false-positive query-params warning)

1.1.7

  • Fix: Like and Liked Posts widgets no longer render a visitor’s own like status or liked-posts list into the cached page HTML, preventing incorrect or leaked state under full-page caching (WP Rocket, LiteSpeed Cache, hosting edge caches, etc.)
  • Build: hardened against WordPress.org Plugin Check findings (output escaping, input sanitization, safe redirects)

1.1.6

  • Privacy: clarified Freemius opt-in and disclosed transmitted data

For older releases, see CHANGELOG.md in the source repository.

Back to top