The Comment Fiasco: How One “Testing” Comment Led Me to a Hidden Snippet, 110 Spam Bots, and a Baseball Script

My author page said "Comments: 1." Finding that one comment took me through a vanished admin menu, a redirecting URL, a forgotten WPCode snippet, 110 spam bots, and an MLB scores script I'd forgotten I wrote. By the end, the count was zero.

The Comment Fiasco

It started with a simple question. My author page on ny2honolulu.com showed “Comments: 1.” With 195 articles published, I wanted to know what that one comment was.

Finding the Comment

In the WordPress dashboard, under Activity → Recent Comments, I found it: a comment from me, on my own post “Maintenance Log: Site Check & Refresh – Feb 15, 2026.” It said:

testing

That was my entire comment history, one test message from February.

Then It Disappeared

While poking around, I hovered over the comment and clicked Spam. That wasn’t the Spam (109) filter link; it was the action link that marks a comment as spam. The comment was my only approved one, so WordPress dropped the “1 Comment” line from At a Glance and removed the Recent Comments section entirely.

I had lost my only comment in about ten seconds.

The Missing Menu

I tried to open the Comments screen to get it back, but there was no Comments item in my sidebar. When I typed the address directly:

https://ny2honolulu.com/wp-admin/edit-comments.php?comment_status=spam

it bounced me straight back to the Dashboard. A missing menu plus a redirect meant something was deliberately hiding comments.

The Culprit: A Snippet I Forgot About

In Code Snippets (WPCode), I found it:

IDSnippetStatusAdded
1673Completely Disable CommentsActiveFeb 19, 2026

I’d added it from the WPCode library four days after my test comment and forgot it existed. It removes the Comments menu, redirects the Comments screen to the Dashboard, and closes comments sitewide. It did exactly what it was built to do.

Clicking the yellow Update Available button next to it brought up a prompt to connect a WPCode Library account. That’s optional, so I closed it.

I toggled the snippet off, loaded the URL again, and the Comments screen opened.

Inside the Spam Folder: 110 Bots and Me

The spam folder had 110 entries: mine, plus 109 bot comments, all from December 2025. As a cybersecurity learner, I found a few things worth noting:

  • Every comment showed the same IP, 10.30.54.250. That’s a private address, which belongs to my host’s proxy or load balancer, not the spammers. WordPress records the proxy’s address instead of the visitor’s, so blocking by IP wouldn’t work on my setup.
  • The content was classic spam: dozens of shorturl.fm links hiding their real destinations, “888starz” casino ads, a giant SEO block about divorce lawyers, and one mentioning xrumer, a well-known automated spam-posting tool.
  • Bots don’t care what a post is about. They crawl for WordPress sites, find every open “Leave a Reply” form, and send form data straight to wp-comments-post.php. The same bot names hit unrelated posts within minutes: Tor Setup, Kali VM Cleanup, an Oracle log, and my MLB scores post.
  • Nothing new has arrived since February, when the disable-comments snippet went on. WordPress’s spam filter had already caught every one before that.

Side Quest: Reviving My MLB Scores Script

One spammed post caught my eye: “Log: MLB Scores Basic Setup (Linux Mint)” from September 2025. It’s a small Python script that pulls the day’s games from the MLB Stats API, using only Python’s built-in libraries (urllib, json), with no pip install needed.

I pasted the restore block from the post into my Debian terminal, and the script worked right away. The menu entry, however, had a bug:

Exec=/home/$USER/.local/bin/mlb-scores

The .desktop file is written with a quoted heredoc (<<'EOF'), so the shell writes $USER literally, and desktop menus don’t expand variables. This fixed it:

sed -i "s|/home/\$USER|$HOME|" ~/.local/share/applications/mlb-scores.desktop

The \$USER is escaped so sed searches for the literal text, while $HOME gets expanded by the shell to my real path. For future restores, the permanent fix is to use <<EOF without quotes on that one heredoc. The Python heredoc (<<'PY') should stay quoted, so the shell doesn’t touch the f-strings.

Then I added a short alias:

echo "alias mlb='~/.local/bin/mlb-scores'" >> ~/.bashrc
source ~/.bashrc

Now mlb gives me the day’s scoreboard:

MLB Games for 2026-09-21
---------------------------------------------------------------
Toronto Blue Jays at Baltimore Orioles — Pre-Game | Toronto Blue Jays: 0  Baltimore Orioles: 0
Washington Nationals at Detroit Tigers — Pre-Game | Washington Nationals: 0  Detroit Tigers: 0
Minnesota Twins at San Francisco Giants — Scheduled

The script fetches today’s date every time it runs, so it keeps working through the end of the season and into the postseason, then prints “No games found” on off days and through the offseason.

Cleaning House

Back in WordPress, I clicked Empty Spam. WordPress confirmed it: 110 comments permanently deleted. Every count on the Comments screen went to zero: All, Mine, Pending, Approved, Spam, and Trash. My “testing” comment went with them, so the comment that started this whole hunt is gone, and my author page now reads Comments: 0.

Then I switched “Completely Disable Comments” back on. The Comments menu vanished from the sidebar again, which confirmed the snippet was working. Comments stay closed sitewide, so the bots have nowhere to post.

Lessons Learned

  1. Hover links are actions, not filters. “Spam” under a comment moves that comment; “Spam (109)” at the top just shows the list.
  2. Document your snippets. A forgotten snippet cost me more time than any bug. Adding a note or tag when I install one would have saved the hunt.
  3. A redirect is evidence. When a URL bounces you somewhere else, something is intercepting it, so look for plugins and snippets.
  4. Private IPs in logs mean a proxy. 10.x.x.x addresses are never the real visitor.
  5. Quoted vs. unquoted heredocs matter. <<'EOF' keeps text literal; <<EOF expands variables. Choose based on whether you want the shell involved.
  6. Old projects are worth revisiting. A spam comment led me back to a script I’d forgotten about, and it’s now on my daily command list.

What’s Left

One item remains: updating the MLB Scores post with the <<EOF fix, a Debian note, and the mlb alias. I’ll do that while the scores load.