Changelog — Pure Comments Docs

1.8.5 - 28 October 2026

Changed

Webmentions Refactor & Fediverse Decoupling: Completely removed all Fediverse, Bridgy, and ActivityPub backfeed integrations to restore Webmentions to their original IndieWeb purpose: simple, self-contained notification citations. Inspired by Manu Moreale’s thoughts on privacy and webmentions and detailed in my announcement, Pure Comments and the Fediverse.
Self-Contained Architecture: Removed all reliance on third-party services such as Bridgy and webmention.io. The native Webmention receiver endpoint and direct W3C endpoint discovery now operate 100% locally and independently.
Dedicated Webmentions Section: Webmentions are now presented in a dedicated “Webmentions” section on the frontend widget rather than threaded directly into the comment tree. Each mention displays the source post title, site/author name, link to the source post, timestamp, and a clean excerpt.
- 📝 Note: Make sure you update your Comments CSS if you’re using your own stylesheet to ensure Webmentions are styles correctly.
Microformats Parser Simplification: Streamlined the HTML and microformats parser to extract only post title, author/site name, website, and an excerpt without downloading third-party images or scraping full post bodies.
Admin Panel Clean-up: Removed the Fediverse profile URL setting, Bridgy publish markup, Fediverse handle checks, and the dashboard reactions filter. Replaced separate reaction and reply auto-approve toggles with a single “Auto-approve incoming Webmentions” setting.
⚠️⚠️ WARNING - Automatic Legacy Data Purge: Upgrading automatically purges legacy Fediverse data (likes, boosts, and Bridgy replies) along with any child replies from the database to prevent orphaned partial conversations.
- Mention Excerpt Clean-up & Image Stripping: All images are stripped completely from Webmention excerpts to keep mentions neat and uncluttered. Existing mentions in the database are automatically reformatted to match the new clean excerpt layout.
- Legacy Title Migration & Backfill: Upgrading automatically backfills post titles for legacy Webmentions that lacked titles from earlier versions by fetching their source metadata once, recording the migration in a new schema_migrations table.
Webmention Display Polish: The frontend embed widget deduplicates titles and author names, preventing author names from repeating if a mention’s title matches or falls back to the author’s name.

Fixed

Webmention Status Demotion & Notification Floods: Fixed a bug where incoming re-pings from static site builds demoted previously approved Webmentions back to pending and re-sent moderation notification emails on every automated rebuild. Webmentions now preserve their published status and re-pings no longer trigger duplicate notification emails.
Webmention Resurrection on Deletion: Fixed an issue where deleting a Webmention from the moderation dashboard purged the row from the database without recording the deletion, leading subsequent static site deploys from the sender to recreate it as a new pending comment. Deleting a Webmention now automatically registers its source URL in blocked_webmentions, ignoring future re-pings.

Added

Webmention Source & Domain Blocklist: Added a “Blocked sources & domains” management setting under Spam & Webmentions. Blocked domains or URLs are immediately rejected with an HTTP 202 response without downloading remote content or dispatching moderation emails.

1.8.4 - 22 October 2026

Fixed

Fixed an issue where reply notification emails and admin dashboard links broke on sites with nested URL structures (such as date-based paths, categories, or subdirectories). Pure Comments now records the post path and correctly reconstructs URLs for nested paths. Thanks to @ScootRay for reporting issue #9.

Added

Added support for beta updates.
Added support for the data-post-path attribute on the comment container to optionally specify an explicit post path. Read the docs.
Added support for the $config['post_paths'] configuration option to allow manual slug-to-path overrides.

1.8.3 - 19 October 2026

Added

Added support for the data-autoload attribute on the comment container and script tag, allowing comments and the submission form to load automatically via IntersectionObserver without requiring a button click. Read the docs.
- Thanks to Ray for the idea.
Added Dutch language support. Thanks to @RobbyTown for pull request #8.

1.8.2 - 09 October 2026

Fixed

Fixed an issue where Fediverse comments replying to other Fediverse comments arrived unthreaded as top-level comments. Pure Comments now extracts in-reply-to targets from incoming Webmentions and nests replies under their respective parent comments. Thanks to @BenediktFloeser for reporting issue #7.
Fixed an issue on smaller screens where Fediverse and Webmention badges or long author names caused comment headers and timestamps to overflow and wrap improperly.
Fixed an issue on the updates page where the back button linked to settings instead of the comments dashboard.

1.8.1 - 25 September 2026

Fixed

Fixed an issue where Bridgy backfeed comment URLs were improperly translated into invalid Fediverse post URLs, causing reply publishing to fail.
Fixed comment.php endpoint URLs in reply Webmentions to resolve against the moderation base URL so subfolder installations are preserved.
Improved Fediverse target detection in outgoing Webmentions to support various Fediverse instance URL schemes.

Added

Added warning notice to read docs on Webmention settings.

1.8.0 - 21 September 2026

Added

Native Multi-Factor Authentication in User Settings.
- SVG QR code generation and manual secret key copying during MFA setup.
- 8 single-use recovery backup codes with one-click copying to prevent administrator lockouts.
- Two-step login authentication challenge supporting both 6-digit TOTP codes and backup recovery codes, integrated with IP rate limiting and lockout protection.
Settings UI with Tabs: Restructured the settings interface into dedicated tabs (General, Author & Email, Spam & Webmentions, Customisation, User, and Updates).
Global Keyboard Shortcut: Added Ctrl+S / Cmd+S shortcut across all settings pages to quickly save settings.
Admin Customisation: Added admin font stack selection (Monospace, Inter, Merriweather) with bundled local font files, alongside an admin custom CSS editor saved to data/css/admin-custom.css.
Update Notification Banners: Added update alert banners to the admin dashboard and settings navigation backed by a cached release checker.

Changed

Moved update result and backup path notices in updates.php to the top of the page directly beneath the heading and navigation tabs.
Added data/ to preserved updater paths so custom CSS and local cache files are protected during updates.
Added rules to .htaccess that prevent public access to the db and backup folders.

Fixed

Fixed an issue where the configured author avatar URL was not returned in the embed comments API or displayed for author comments and admin replies.
Fixed styling for single-line error notices across the admin interface so they render with consistent red borders and backgrounds in both light and dark mode.

1.7.4 - 15 September 2026

Fixed

Fixed an issue where attached images in Fediverse comments and Webmentions (such as u-photo entry attachments or JSON-LD media) were omitted and stripped during HTML sanitisation.

1.7.3 - 11 September 2026

Added

Added DoS throttling protection for moderation notification emails, ensuring that surges of incoming comments or Webmentions within a 5-minute window only trigger a single notification email.

Changed

Boosts and likes are now hidden by default on the administration dashboard to reduce clutter, with a rocker switch toggle added below the search box to view them on demand.

Fixed

Fixed an issue where author replies published to the Fediverse via Bridgy were backfed via Webmentions and created duplicate loopback comments. Incoming Webmentions originating from the configured author Fediverse profile or site domain are now automatically identified and filtered out.

1.7.2 - 08 September 2026

Fixed

Fixed Fediverse reply mentions in the administration panel so replies extract and target the author’s full @username@instance handle from their profile URL instead of prepending @ to display names.
Fixed Fediverse conversation threading for published author replies by translating Bridgy comment URLs into canonical Fediverse status URLs in comment.php, ensuring replies correctly attach to live threads.
Resolved author reply Webmention source URLs via post_base_url and added <link rel="me"> author discovery links in comment.php.

1.7.1 - 08 September 2026

Fixed

Fixed an issue where Webmentions targeting a site’s root homepage URL were incorrectly attributed to the most recently commented post slug instead of resolving to home.
Fixed an issue in the in-app updater where root files introduced in newer versions (such as comment.php) were not tracked in the core file list and were therefore omitted during updates.

Changed

Improved input field and textarea spacing in the embedded comment form.
Refined avatar rendering for reaction facepiles.

v1.7.0 - 07 September 2026

Added

Webmentions & Fediverse backfeed support: Pure Comments can now receive and display Webmentions from IndieWeb blogs as well as backfeed replies, likes, and boosts from the Fediverse via Bridgy.
Reaction facepiles: Likes and boosts are aggregated and displayed as compact avatar facepiles above the comments section, with singular/plural count formatting.
Webmention author replies: Author replies submitted via the administration panel generate IndieWeb-compatible h-entry permalinks for Webmention replies.
Webmention settings & moderation controls: Added configuration options to enable Webmentions, specify your personal Fediverse profile URL for <link rel="me"> discovery, and toggle auto-approval separately for reactions and text replies.
Documentation: Added a detailed guide on Webmentions & Fediverse integration.

Changed

Non-textual reactions in the administration panel now display an informative notice rather than an empty placeholder, and the reply form is automatically disabled for likes and boosts.
Simplified reply button verbiage and standardised translation keys across all supported languages (English, German, French, Italian, Romanian).

v1.6.7 - 27 July 2026

Changed

Migrated the in-app updater check endpoint to pull release metadata from packages.purecommons.org/comments/latest.json instead of the GitHub Releases API.
Added a 🎉 New Version Available status header above the release metadata in the updates panel.

v1.6.6 - 19 July 2026

Changed

Moved back to GitHub for repo hosting.
Localised the PHP timezone and date format documentation links in the setup and settings forms, allowing both the link text and URLs to be translated (thanks @citizenk for reporting this in issue #10).

Added

Updated Italian translations, completing missing localisation strings (thanks @citizenk for #6) and #9.
Added French translations (thanks @citizenk for #8).

v1.6.5 - 07 July 2026

Changed

Updated the license to version 1.1 to restrict only commercial hosting for a fee, while explicitly permitting free hosting for friends and family.

Added

Updated Romanian translations, completing previously missing localisation strings (thanks @ThinkRoot for #5).

v1.6.4 - 04 July 2026

Fixed

Fixed translation issues in the embed widget where the comments title, load button, and loading indicator were stuck in English. Timestamps are also now dynamically localized using client-side Intl formatting (thanks @Ted11 for #4).

v1.6.3 - 29 June 2026

Fixed

Fixed an issue where the pending comments list in the admin panel incorrectly excluded comments from guests who submitted a comment with a name matching the admin author’s name (thanks @daj for #3).

v1.6.2 - 26 June 2026

Security

Secured the “Remember me” cookie mechanism by replacing the static HMAC token with random, database-backed tokens stored in a new remember_tokens table. Tokens are now invalidated on the server when logging out.

Fixed

Fixed an Undefined array key "smtp_debug" PHP notice when saving configurations with Amazon SES or no email provider selected.

v1.6.1 - 13 June 2026

Updated

German translations for search (thanks @bttr for #2)

v1.6.0 - 27 May 2026

Added

Pure Comments logo now appears on all admin pages (dashboard, settings, updates, login).
Search box on the dashboard to search comments by name or content (search terms are preserved when paginating through results).

Changed

Admin page headers and links are now themed red to match the Pure Comments brand colour.
Replaced emoji favicon with the Pure Comments logo.

v1.5.2 - 09 May 2026

Pure Comments has moved from GitHub to GitHub. The update checker now fetches release information from GitHub, and all relevant links have been updated accordingly.

Upgrade notice - This release restructures the in-app updater so a manual update is required.

Manual upgrade steps

Back up your site — download a copy of your entire Pure Comments directory before proceeding.
Download the v1.5.2 release zip from the GitHub releases page and extract it.
Delete everything EXCEPT for the db/ directory and the config.php file.
Copy the new files to your existing installation, replacing everything except your db/ directory and config.php file.

v1.5.1 - 04 May 2026

Updated license to v1.1: commercial self-use is now explicitly permitted.
Added Italian translation (thanks Elena Brescacin)

1.5.0 - 25 April 2026

New features

“Remember me” checkbox on the login page; sets a 90-day persistent cookie so the browser session survives a restart.
Filter by post - each comment row in the dashboard now has a “Filter by this post” link that scopes both pending and published lists to that post.
Filter by commenter - each comment row has a “Filter by this commenter” link; filters by email if the commenter provided one, otherwise by name.

Note: Translations for new strings were done by an AI, so will likely need a human review.

Improvements

Enhanced German translation (thanks werschreibt).

1.4.1 - 21 April 2026

Fixed incorrect email encoding for UTF-8 characters (e.g. umlauts) in SMTP notifications (fixes #2)
Added SMTP debug logging toggle to settings — displays the full SMTP conversation log in the admin UI when sending a test email (fixes #4)
Fixed updater not replacing the lang/ directory when upgrading — lang files will now be updated correctly from this version onwards

⚠️ One-off manual step for anyone upgrading to v1.4.1: the updater could not replace your lang files during this upgrade, so you will need to manually copy the lang/ directory from the release zip to your installation.

1.4.0 - 14 April 2026

Added translation support. Currently has English (en.php) and German (de.php). German translations were created by AI, so please submit a PR if updates are required. Read the docs.

⚠️⚠️⚠️⚠️ IMPORTANT NOTE AFTER UPDATING: Your site will produce a 500 error after updating. This is expected behaviour. It's because the current updater doesn't expect the /lang directory, so it won't copy the language files over during the update.

To fix this you have to manually copy the /lang directory to the root of your comments install. This is a one off action. Future updates will be fine.

1.3.2 — 21 March 2026

Fixed

The privacy policy URL field in settings is now optional. If left blank, the privacy link is hidden from the comment form entirely.

1.3.1 — 6 March 2026

Added

Rate limiting for comment submissions.

Fixed

Prevented unauthorised database downloads; emails are now encrypted at rest.

1.3.0 — 6 March 2026

Added

SMTP support for comment notification emails, with a test mail option in settings.