Comments, pingbacks, and trackbacks » Rate-limit accepted comments
TL;DR
WP fail2ban Free can record each accepted comment through the extra filter. Match that filter with its own fail2ban jail, and you can rate-limit a source that posts above your chosen threshold without treating one valid submission as an attack.
Free is configured through wp-config.php. Premium lets you configure the control through WordPress admin and keeps accepted-comment activity in the event history, so you can choose a threshold from the way your site is actually used.
Count accepted comments without calling them failures
WordPress has already accepted the comment. That does not mean your site has to accept an unlimited number from the same source in a short period.
WP fail2ban records the successful outcome through extra, rather than classifying it as a soft or hard failure. A separate fail2ban jail can count those events and act when the volume crosses the limit you set.
The comment that produced the event remains accepted. The firewall limit applies to subsequent requests from that source.
Keep volume in its own policy
Accepted comments, invalid targets, and spam decisions mean different things. Giving accepted comments their own jail keeps a volume threshold separate from the softer pattern of repeated mistakes and the hard judgement that something is spam.
You can therefore limit a bot whose comments pass WordPress's checks without changing how invalid attempts or spam decisions are handled.
Choose a threshold that fits the site
A quiet company blog and a busy community site do not have the same normal comment rate. Several legitimate users may also share one public IP address.
You choose how many accepted comments one source may generate and over what period. The threshold can leave room for the conversations your site expects while putting a ceiling on automated volume.
See normal activity before setting the limit
Premium keeps accepted-comment activity in the persistent event history. You can review which sources post successfully and how normal volume varies before deciding what your separate fail2ban jail should tolerate.
That turns the threshold into a site-specific policy rather than a number copied from someone else's configuration.
