Smart Moderator

About

Smart Moderator v2.0.0 automatically reviews new posts and comments using AI (OpenAI GPT or Anthropic Claude) to prevent spam, abuse, and harmful content before publication. Administrators bypass all AI moderation to save API costs and enable quick publishing.

Key Features

• AI-driven moderation - Content is reviewed by OpenAI or Anthropic Claude via secure API
• Admin bypass - Administrators skip AI moderation entirely (no API cost for admin actions)
• Admin override system - Admins can manually approve AI-rejected content without re-moderation loops
• Custom prompts - Define global moderation rules and add context for posts or comments separately
• Immediate moderation - Content is approved or rejected as soon as it's saved
• Rejected content reverts to draft - Rejected posts become drafts (author-only visibility) so authors can revise and resubmit
• Theme & plugin friendly - Run your own rejection routine (e.g. email the author and set the ad to draft) via the smartmoderator_reject_post hook
• API failure rate limiting - Automatically pauses API calls after repeated failures to prevent hammering the endpoint
• Audit log with retention - Decisions are stored in a dedicated table and kept for a configurable period (default 30 days), then pruned automatically
• Automatic model detection for OpenAI - No configuration needed for token limits
• GPT-5 reasoning optimization - Automatically uses low reasoning effort for efficient moderation
• Secure storage - API keys kept in database, never logged, transmitted only via HTTPS
• Compatible - Works with WordPress comment moderation settings and other plugins

How It Works

1. User submits a post or comment
2. Check if the user is an administrator:
   • ✅ If admin → Skip all moderation, publish immediately (no API cost)
   • ❌ If non-admin → Continue to step 3
3. Smart Moderator sends content to your AI endpoint (OpenAI or Anthropic Claude)
4. AI returns "approve" or "reject" with optional reason
5. Plugin updates post/comment status immediately:
   • Approved → published (if permissions allow)
   • Rejected post → reverted to draft (author-only visibility); rejected comment → held for moderation
6. Themes and plugins can take over the rejection outcome via the smartmoderator_reject_post action (see Developer Hooks). When no listener is registered, the plugin applies its own default.

Developer Hooks (Theme Integration)

Smart Moderator fires hooks so your theme or another plugin can react to moderation decisions without editing the plugin.

• smartmoderator_reject_post (action) - Fires when a post is rejected, passing $post_id, $post, and $reason. If any callback is attached it fully owns the outcome and the plugin's default status change is skipped.
• smartmoderator_rejected_post_status (filter) - The status applied to rejected posts when no smartmoderator_reject_post listener exists. Default draft.
• smartmoderator_approve_post (action) - Mirrors the reject action for approvals. If attached it fully owns the outcome (e.g. a payment-gated theme that publishes through its own flow instead of letting the AI publish).
• smartmoderator_approved_post_status (filter) - The status applied to approved posts. Default publish.
• smartmoderator_trigger_statuses (filter) - Which statuses trigger moderation. Default pending + publish (also a setting).
• smartmoderator_decision_reuse_window (filter) - Seconds a decision is reused when identical content is re-saved (absorbs duplicate saves of one submission). Default 600; 0 disables reuse.
• smartmoderator_log_retention_days (filter) - Days to keep logs (0 = keep indefinitely).
• smartmoderator_log_max_rows (filter) - Hard cap on stored log rows (0 = no cap).

Example - reject an ad by emailing its author and reverting it to draft (drop this in your theme's functions.php):

add_action( 'smartmoderator_reject_post', function ( $post_id, $post, $reason ) {
    // 1. Send the ad back to draft (visible only to its author).
    wp_update_post( [ 'ID' => $post_id, 'post_status' => 'draft' ] );

    // 2. Email the author about the rejection.
    $author = get_userdata( (int) $post->post_author );
    if ( $author && $author->user_email ) {
        wp_mail(
            $author->user_email,
            'Your ad was not approved',
            "Hi {$author->display_name},\n\n"
            . "Your ad \"{$post->post_title}\" was moved back to draft.\n"
            . ( $reason ? "Reason: {$reason}\n\n" : "\n" )
            . "Please edit it and resubmit."
        );
    }
}, 10, 3 );

The decision and reason are also saved as post meta (_smartmoderator_ai_decision, _smartmoderator_ai_reason) if you need them elsewhere.

Privacy & Data Handling

• API key stored locally in WordPress database
• Logs include only decision outcomes, reasons, and timestamps - not full content
• Smart Moderator makes requests only to your configured endpoint over HTTPS
• No user tracking or telemetry
• Admin content never sent to AI: Administrators bypass all moderation (no API calls)
• For posts: sends title + content (non-admin users only)
• For comments: sends comment text only, not commenter name/email (non-admin users only)

Supported AI Models

Recommended Models

OpenAI:

• gpt-4o-mini - Fastest, most economical ($0.15/M)
• gpt-4o - Balanced performance ($2.50/M) ✅ Recommended
• gpt-5-nano - Ultra-fast reasoning model ($0.05/M input, $0.40/M output)

Claude:

• claude-haiku-4-5 - Fastest ($1/M)
• claude-sonnet-4-20250514 - Balanced ($3/M) ✅ Recommended
• claude-opus-4-1-20250805 - Maximum intelligence ($15/M)

Cost Examples

• OpenAI gpt-4o-mini: ~$0.15 per 1,000 comments
• OpenAI gpt-4o: ~$2.50 per 1,000 comments
• OpenAI gpt-5-nano: ~$0.05-$0.40 per 1,000 comments
• Anthropic claude-haiku-4-5: ~$1.00 per 1,000 comments
• Anthropic claude-sonnet-4: ~$3.00 per 1,000 comments

Typical blog with 100 comments/month: $0.01-$0.30/month

Installation

Quick Install

1. Upload plugin to /wp-content/plugins/ directory
2. Activate through Plugins → Installed Plugins
3. Go to Tools → Smart Moderator
4. Follow setup guide below for your chosen AI provider

Setup Guides

Frequently Asked Questions

Compatibility

• WordPress 6.0+ (tested up to 6.8)
• PHP 8.0+ (required)
• OpenAI API (all GPT models including GPT-5 series)
• Anthropic Claude API (all Claude 2.x, 3.x, and 4.x models)
• Works with: WooCommerce, bbPress, BuddyPress, and most comment plugins
• Compatible with: All major caching plugins, security plugins

Performance

• Minimal impact on site speed (moderation runs asynchronously)
• No front-end JavaScript or CSS
• No database queries on front-end
• Optimized for OpenAI and Claude APIs with automatic model detection

Security

• No eval(), exec(), or dangerous functions
• All database queries use $wpdb->prepare()
• All output escaped
• All input validated and sanitized
• API keys never appear in logs or debug output

Changelog

Version 2.1.0

• New - Genuine AI errors are logged as a "Skipped (AI error)" entry (once per item, configured sites only) so admins can see which content the AI could not evaluate.
• New - Editing an already-published or pending ad re-moderates it when the content changes (genuine user edits only — programmatic/cron updates are skipped), so post-approval edits (e.g. added spam) are caught.
• New - "Moderate when a post becomes" setting to choose which statuses trigger moderation (default Pending + Published; includes any custom statuses your theme registers).
• New - "When a post is approved, set it to" setting plus a smartmoderator_approve_post action / smartmoderator_approved_post_status filter, so themes with their own publish flow (e.g. payment-gated ads) can control what "approved" does. Default Published (no change).
• Improved - The recursion guard now uses a short-lived transient, so a fatal error mid-moderation can't permanently wedge a post.
• Security - Outbound API requests now use wp_safe_remote_post(), blocking loopback/private/link-local hosts (SSRF mitigation for the configurable endpoint).
• Security/Compliance - Admin JavaScript and CSS are now enqueued (no inline scripts/styles); removed verbose debug logging; prefixed all internal class names to avoid collisions.
• Fixed - API failures now correctly leave content untouched and engage rate limiting (previously some error paths could auto-approve).
• Changed - On API error, missing config, or rate limiting, the plugin now does nothing (leaves content unchanged) instead of defaulting to "approve". It only changes status on an explicit AI approve/reject.
• New - No-code rejection settings: choose the status rejected posts are set to (default Draft), and optionally name a theme action to trigger on rejection — no functions.php editing required.
• Changed - Rejected posts are now reverted to draft (author-only visibility) instead of pending, so authors can revise and resubmit.
• New - Developer hooks for integrating with themes/plugins: smartmoderator_reject_post (action), smartmoderator_rejected_post_status (filter), smartmoderator_reenforce_decision (filter), smartmoderator_log_retention_days (filter), and smartmoderator_log_max_rows (filter).
• Changed - The default-on "Enforce moderation result" 60-second re-enforcement has been removed from the UI. It fought other plugins/themes and is now off by default, available only via the smartmoderator_reenforce_decision filter.
• New - Moderation logs are now stored in a dedicated table with a configurable retention period (default 30 days) instead of being wiped in full every day. New "Keep moderation logs for" setting.
• Improved - Logging no longer accumulates in post/comment meta, keeping core tables lean on high-volume sites.

Version 2.0.0

• Major refactoring - Complete architecture redesign following SOLID principles
• Breaking change - Now explicitly supports only OpenAI and Claude (removed generic API support)
• New - Proper OpenAI API implementation with full GPT-4, GPT-4o, O1 model support
• New - Proper Claude API implementation with full Claude 3.5 and Claude 3 family support
• New - Auto-detection of AI provider based on endpoint URL
• Fixed - Editor post updates now properly remoderated (bug fix)
• Fixed - Response format parsing now provider-specific and more reliable
• Improved - Better error messages with provider context
• Improved - Type-safe value objects (Moderation_Result, Moderation_Config)
• Improved - Strategy pattern for API clients (easy to extend in future)
• Improved - Comprehensive error logging with provider identification
• Code quality - Follows WordPress coding standards and PHP best practices
• Code quality - Full separation of concerns (API logic separated from WordPress integration)

Version 1.1.0

• Initial public release
• AI-powered moderation for posts and comments
• Support for Anthropic Claude and OpenAI GPT APIs
• Custom moderation prompts per content type
• "Enforce moderation result" feature - re-checks after 60s to prevent overrides
• Comprehensive error handling with user-friendly messages
• Detailed moderation logging
• Secure API key storage
• Full WordPress.org compliance

Support

For support, bug reports, or feature requests, please contact the plugin author at linda.scoon@purplefootsteps.co.uk.

Get Started

Get started with Smart Moderator today and protect your WordPress site from spam and harmful content.

Contact the plugin author for installation instructions and access.