Title: Subscribe to Comments Author: Mark Jaquith Published: 9 June 2005 Last modified: 6 October 2026 --- Search plugins ![](https://s.w.org/plugins/geopattern-icon/subscribe-to-comments.svg) # Subscribe to Comments By [Mark Jaquith](https://profiles.wordpress.org/markjaquith/) [Download](https://downloads.wordpress.org/plugin/subscribe-to-comments.2.3.3.zip) * [Details](https://en-gb.wordpress.org/plugins/subscribe-to-comments/#description) * [Reviews](https://en-gb.wordpress.org/plugins/subscribe-to-comments/#reviews) * [Installation](https://en-gb.wordpress.org/plugins/subscribe-to-comments/#installation) * [Development](https://en-gb.wordpress.org/plugins/subscribe-to-comments/#developers) [Support](https://wordpress.org/support/plugin/subscribe-to-comments/) ## Description Subscribe to Comments is a robust plugin that enables commenters to sign up for e-mail notification of subsequent entries. The plugin includes a full-featured subscription manager that your commenters can use to unsubscribe to certain posts, block all notifications, or even change their notification e-mail address! ## Installation 1. Put subscribe-to-comments.php into [wordpress_dir]/wp-content/plugins/ 2. Go into the WordPress admin interface and activate the plugin 3. Optional: if your WordPress theme doesn’t have the comment_form hook, or if you would like to manually determine where in your comments form the subscribe checkbox appears, enter this where you would like it: `` 4. Optional: If you would like to enable users to subscribe to comments without having to first leave a comment, place this somewhere in your template, but make sure it is **outside the comments form**. A good place would be right after the ending` ` tag for the comments form: `` ## FAQ ### How can I tell if it’s working? 1. Log out of WordPress 2. Leave a comment on an entry and check the comment subscription box, using an e- mail that is NOT the WP admin e-mail address or the e-mail address of the author of the post. 3. Leave a second comment using a different e-mail address than the one you used in step 2 (it can be a bogus address). 4. This should trigger a notification to the first address you used. ### I’d like the subscription checkbox to be checked by default. Can I do that? Not anymore. But the checkbox status will be remembered on a per-user basis. ### My subscription checkbox shows up in a strange place. How do I fix it? Try unchecking the CSS “clear” option. Beyond that, you’re on your own with CSS positioning. ## Reviews ![](https://secure.gravatar.com/avatar/92ec3457adc6bcdf7a3e43a8f91d057dc6295a650a9e881ea1ae099e0356b238? s=60&d=retro&r=g) ### 󠀁[Не совместим с 4.5.2](https://wordpress.org/support/topic/%d0%9d%d0%b5-%d1%81%d0%be%d0%b2%d0%bc%d0%b5%d1%81%d1%82%d0%b8%d0%bc-%d1%81-452/)󠁿 [Budtoturisto](https://profiles.wordpress.org/sunchess/) 3 September 2016 Функция get_currentuserinfo с версии 4.5 считается устаревшей! Используйте wp_get_current_user(). ![](https://secure.gravatar.com/avatar/995862399a0a45641a4d02cb9d7750277eec40e767e8667a90f4899b38f515f1? s=60&d=retro&r=g) ### 󠀁[Simple and easy.](https://wordpress.org/support/topic/simple-and-easy-170/)󠁿 [Andres Gomez](https://profiles.wordpress.org/tanty0/) 3 September 2016 I'm a long term user of this plugin. It just works! I would welcome support for multilanguage sites, but this is a minor enhancement. ![](https://secure.gravatar.com/avatar/04fc126d71db384ee5d4b04644df3216b26f1e3453a1dae083fa5c882fe13bbf? s=60&d=retro&r=g) ### 󠀁[Plugn is no longer stable](https://wordpress.org/support/topic/plugn-is-no-longer-stable/)󠁿 [EOSlover](https://profiles.wordpress.org/eoslover/) 3 September 2016 Plugin is no longer stable and is interfering with other plugins. [ Read all 14 reviews ](https://wordpress.org/support/plugin/subscribe-to-comments/reviews/) ## Contributors and Developers “Subscribe to Comments” is open source software. The following people have contributed to this plugin. Contributors * [ Mark Jaquith ](https://profiles.wordpress.org/markjaquith/) * [ Joen Asmussen ](https://profiles.wordpress.org/joen/) [Translate “Subscribe to Comments” into your language.](https://translate.wordpress.org/projects/wp-plugins/subscribe-to-comments) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/subscribe-to-comments/), check out the [SVN repository](https://plugins.svn.wordpress.org/subscribe-to-comments/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/subscribe-to-comments/) by [RSS](https://plugins.trac.wordpress.org/log/subscribe-to-comments/?limit=100&mode=stop_on_copy&format=rss). ## Change Log #### 2.3.3 * Security: Verify email changes through the destination inbox before transferring subscriptions or revealing its management key. Confirmation links are purpose- bound, expire after one day, and cannot be replayed after use. * Security: Rotate management keys again to revoke links that could have been exposed by the email-change flow. Retired keys remain recognizable but never authorize access. Subscriptions and existing settings are preserved. * Security: Protect migration markers with a server-secret signature so old author- accessible settings cannot preserve a known key salt. * Honor double opt-in for standalone subscriptions and require fresh inbox confirmation for guest subscriptions, including addresses already subscribed elsewhere. Limit confirmation emails to one per address per day. * Preserve valid percent and apostrophe characters in subscriber email addresses, and make unsubscribe controls work immediately after confirmation. * Restrict custom layout includes to active-theme PHP files, prevent management- page referrer disclosure, and disable caching of private management pages. * Do not trust self-edited WordPress profile email addresses as proof of inbox ownership. Non-administrators manage subscriptions through emailed links. * Pause email-only notifications when posts become private, unpublished, or password- protected. Preserve subscriptions and hide nonpublic post titles from unauthorized management-page viewers. * Thanks to Het Kalariya for reporting the original vulnerabilities. * Improve modern PHP compatibility and initialize the plugin after WordPress APIs and translations are available. * Restore notifications for modern WordPress comment types and fix double opt-in, email-change, and unblock flows. * Protect subscription-manager and standalone-subscription forms with nonces, including administrator requests. * Validate malformed form values and disallow standalone subscriptions to unpublished, password-protected, or closed posts. * Escape frontend and administrator output, restrict form markup, and prepare SQL identifiers and limits. * Require WordPress 6.2 or later for prepared SQL identifier support, and PHP 7.4 or later. Tested on WordPress 7.1. #### 2.3.2 * Security: Stop using unsigned comment-email cookies to identify subscribers or disclose their management keys, and prevent key disclosure when subscribing without commenting. * Security: Validate and escape subscription-manager return links to prevent reflected cross-site scripting. * Security: Restrict plugin settings to administrators and sanitize notification sender headers to prevent email header injection. * Security: Rotate subscription-management keys once on existing installations. Old management and confirmation links are revoked, with an explanatory message and an administrator notice. Existing subscriptions are preserved, and new emails contain fresh links. * Preserve private key settings when saving plugin options so links remain valid and the security rotation is not repeated. * Guest subscribers manage subscriptions through emailed links. Subscribing without commenting now shows confirmation on the current page instead of redirecting to the subscription manager. * Thanks to Het Kalariya for reporting these vulnerabilities. ## Meta * Version **2.3.3** * Last updated **5 days ago** * Active installations **10,000+** * WordPress version ** 6.2 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/subscribe-to-comments/) * Tags * [comments](https://en-gb.wordpress.org/plugins/tags/comments/)[email](https://en-gb.wordpress.org/plugins/tags/email/) [subscription](https://en-gb.wordpress.org/plugins/tags/subscription/) * [Advanced View](https://en-gb.wordpress.org/plugins/subscribe-to-comments/advanced/) ## Ratings 3.9 out of 5 stars. * [ 7 5-star reviews ](https://wordpress.org/support/plugin/subscribe-to-comments/reviews/?filter=5) * [ 3 4-star reviews ](https://wordpress.org/support/plugin/subscribe-to-comments/reviews/?filter=4) * [ 1 3-star review ](https://wordpress.org/support/plugin/subscribe-to-comments/reviews/?filter=3) * [ 1 2-star review ](https://wordpress.org/support/plugin/subscribe-to-comments/reviews/?filter=2) * [ 2 1-star reviews ](https://wordpress.org/support/plugin/subscribe-to-comments/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/subscribe-to-comments/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/subscribe-to-comments/reviews/) ## Contributors * [ Mark Jaquith ](https://profiles.wordpress.org/markjaquith/) * [ Joen Asmussen ](https://profiles.wordpress.org/joen/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/subscribe-to-comments/)