Thu Mar 05 2026

...

Self-Service Email Suppression Management

What's New

When an email bounces or a recipient marks it as spam, email providers block future messages to that address. Until now, resolving these suppressions required contacting FastComments support. Now, tenant admins can manage suppressions themselves from a new Suppressed Emails page in the account dashboard.

Why This Matters

A suppressed email means a user or moderator is no longer receiving any notifications from FastComments - reply alerts, mention notifications, admin digests, none of it. Often the person affected doesn't even realize it. With the new self-service page, admins have visibility into which addresses are blocked and can take action immediately.

How It Works

Navigate to Suppressed Emails in the account sidebar. You'll see a table of all suppressed addresses associated with your tenant's users, moderators, and commenters. Each entry shows the email address, suppression type, reason, and date.

To remove a suppression, click Remove, review the details on the confirmation page, and confirm. FastComments will contact the email provider to unblock the address and clear the suppression flag from all associated records.

Removals are rate limited to prevent abuse - one removal per email address every 30 days, and five removals per tenant per calendar month.

Suppressed users and moderators are also now flagged with a red Email Suppressed badge on the Users and Moderators admin pages, linking directly to the suppression management page for that address.

In Conclusion

We hope this gives admins the visibility and control they need to keep their communities connected. If a user reports missing notifications, the answer is now just a few clicks away.

Let us know below if you have any questions!

Cheers!

Mon Mar 02 2026

...

Official Laravel Package Released

What's New

We're excited to announce the release of our official Laravel package, fastcomments/laravel. If you're building with Laravel and want to add commenting, live chat, or comment counts to your application, you can now do so with a single Composer install and a couple of Blade components.

The package supports Laravel 10, 11, and 12 on PHP 8.1+.

Getting Started

Install with Composer:

composer require fastcomments/laravel

Then add your tenant ID and API key to your .env:

FASTCOMMENTS_TENANT_ID=your-tenant-id
FASTCOMMENTS_API_KEY=your-api-key

That's it. The service provider and facade are auto-discovered - no manual registration needed. You can publish the config file for further customization:

php artisan vendor:publish --tag=fastcomments-config

Drop-In Blade Components

The package ships with three Blade components that you can use directly in your templates:

Comments widget:

<x-fastcomments url-id="my-page" />

Live chat widget:

<x-fastcomments-live-chat url-id="my-chat-room" />

Comment count:

<x-fastcomments-comment-count url-id="my-page" />

Each component supports props like url, locale, readonly, has-dark-background, and default-sort-direction. Scripts are loaded asynchronously and deduplicated, so you can safely place multiple widgets on the same page.

Automatic SSO

SSO can be enabled with two environment variables:

FASTCOMMENTS_SSO_ENABLED=true
FASTCOMMENTS_SSO_MODE=secure

Once enabled, the comment and live chat components automatically read Auth::user() and inject the signed SSO payload into the widget config. Logged-in users are seamlessly authenticated. Guests see login and logout links that default to your Laravel login and logout named routes.

There are two ways to control how your User model maps to FastComments user data:

Config-based mapping - set attribute names (including dot notation) or callables in config/fastcomments.php:

'user_map' => [
    'id' => 'id',
    'email' => 'email',
    'username' => 'name',
    'avatar' => 'profile_photo_url',
],

Interface-based mapping - implement MapsToFastCommentsUser on your User model for full control:

use FastComments\Laravel\SSO\Contracts\MapsToFastCommentsUser;

class User extends Authenticatable implements MapsToFastCommentsUser
{
    public function toFastCommentsUserData(): array
    {
        return [
            'id' => (string) $this->id,
            'email' => $this->email,
            'username' => $this->name,
            'avatar' => $this->avatar_url,
            'is_admin' => $this->hasRole('admin'),
        ];
    }
}

Both Secure SSO (HMAC-signed, recommended for production) and Simple SSO modes are supported.

API Integration

The package also wraps the FastComments API with a facade, dependency injection, and direct SDK client injection:

use FastComments\Laravel\Facades\FastComments;

// Admin API
$comments = FastComments::admin()->getComments(...);

// Public API
$counts = FastComments::publicApi()->getCommentCounts(...);

// SSO token for custom use
$token = FastComments::sso()->tokenFor($user);

EU Data Residency

For customers using our EU region, a single environment variable switches all endpoints - widgets, API calls, and SSO:

FASTCOMMENTS_REGION=eu

In Conclusion

We hope this package makes it easy to add FastComments to your Laravel applications. It's available now on Packagist and the source is on GitHub.

Let us know below if you have any feedback!

Cheers!

Sun Mar 01 2026

...

FastComments Moodle Plugin

What's New

We are excited to announce the official FastComments plugin for Moodle. If you have been using Moodle and wanted to add live, threaded commenting or collaborative chat to your courses, this plugin makes it simple. It replaces the old manual PHP approach with a proper Moodle plugin that installs in minutes and integrates with your existing Moodle user accounts. The plugin works with Moodle 4.1 and later, and the source is available on GitHub.

Getting Started

To install, download the ZIP from the GitHub repository and extract it to <moodle-root>/local/fastcomments. Then log in as a site administrator and visit Site Administration > Notifications. Moodle will detect the new plugin and run the install automatically.

Once installed, head to Site Administration > Plugins > Local plugins > FastComments to configure. You will need your Tenant ID (found in your FastComments dashboard) and your API Secret if you want to use Secure SSO, which we recommend.

Note that the manual download from GitHub is temporary while we wait for the plugin to be approved on the Moodle plugin directory. Once approved, you will be able to install it directly from within Moodle's plugin installer.

Commenting Styles

The plugin supports three commenting styles, so you can pick what works best for your students and course structure.

Comments mode places a full comment widget below the page content. Students get threaded replies, @mentions, upvoting and downvoting, a rich text editor, and the notification bell for subscribing to new comments on a page.

Comments on a course page

Collab Chat mode adds a bar at the top of the page that prompts users to select text and start a discussion. The highlighted text is anchored to the content, so the conversation stays tied to exactly what is being discussed. It also shows online users and the number of active discussions. This mode does not render a bottom widget.

Collaborative chat anchored to selected text

Collab Chat + Comments gives you both at the same time. Students can highlight text for inline discussions and also use the full comment widget below the content. This is great for courses where you want both quick inline feedback and longer threaded conversations.

Both commenting styles active on a page

Automatic SSO

The plugin supports three SSO modes. Secure SSO is the recommended option. It signs user identity server-side with HMAC-SHA256 using your API Secret, so credentials are never exposed on the client. With Secure SSO, Moodle admins are automatically synced as FastComments moderators, which means your site administrators can moderate comments without any extra setup. User avatars, names, and email addresses are all passed securely.

Simple SSO passes user data (name, email, avatar) client-side without a signature. It is quick to set up but less secure than the HMAC approach. Finally, None disables SSO entirely, so users comment anonymously.

User Notification Preferences

Students can manage their FastComments notification settings directly from their Moodle profile. Under the FastComments section they can toggle reply notifications (get an email when someone replies to their comment) and subscription notifications (get emails for threads they have subscribed to). This keeps everything in one place and gives students control over how much email they receive.

In Conclusion

The Moodle plugin is available now. For the full setup walkthrough, check out the Moodle Integration Guide, and the source code is on GitHub. Let us know below if you have any feedback!

Cheers!

Sat Feb 28 2026

...

Backup Email for Account Recovery

What's New

You can now add a backup email to your FastComments account. If you ever lose access to your primary email, your backup email can be used to recover your account through any of our existing login flows.

This feature is available to all regular (non-SSO) users.

How It Works

1. Go to your Account Details page.
2. Click the Define a Backup Email link under the email field.
3. Enter your backup email address and submit.
4. Check your inbox for a verification email and click the link to confirm.

Once verified, your backup email is stored and ready to use if you ever need it. You can change or remove it at any time from the same page.

How Recovery Works

Your backup email integrates with all existing recovery paths:

• Forgot Username - Enter your backup email on the forgot username page and your username will be sent to that address.
• Magic Link Login - Enter your backup email as the email address when logging in. A magic link will be sent to your backup email.
• Password Login - You can type your backup email in the username/email field to find your account.

No new recovery flow was needed. Your backup email simply works everywhere your primary email does for authentication purposes.

What It's Not

Your backup email is only used for account recovery. It will not receive notifications, digest emails, or any other communication. It is a safety net, not a second inbox.

In Conclusion

Losing access to an email account is stressful enough without also losing access to all the services tied to it. We hope this small addition gives you peace of mind.

Let us know below if you have any feedback!

Cheers!

Fri Feb 27 2026

...

New IP Login Alerts

What's New

FastComments now automatically sends a security alert email when we detect a sign in to your account from an IP address we haven't seen before. The email includes:

• The approximate location (city and country) of the login.
• The IP address used.
• The time of the login.
• A direct link to change your password if the login wasn't you.

This applies to all login methods: password-based login, magic links, and two-factor authentication flows.

Privacy

We do not store your raw IP address. We only store an obfuscated form for security comparison purposes. The approximate location is determined at the time of login and is not stored.

Your IP is not shared with a third party to determine the location. We host our own service that extracts the approximate location from a (weekly updated) copy of the MaxMind database.

When Alerts Are Sent

An alert is sent when all of the following are true:

• The login was successful.
• It is not the user's first-ever login.
• The IP address has not been seen in a previous successful login for that account.

This means you won't get an alert on your very first login, and you won't get repeated alerts for the same IP.

In Conclusion

This is one more step toward keeping your account safe. If you receive an alert you don't recognize, we recommend changing your password immediately.

Let us know below if you have any feedback!

Cheers!

Tue Feb 17 2026

...

DKIM Configuration Now Available in the UI

What's New

Setting up DKIM for your custom email domain just got easier. Previously, configuring DKIM required using the Domain Configs API directly. Now, you can configure DKIM right from the FastComments admin UI.

Why DKIM Matters

When you customize the From Domain for emails that FastComments sends on your behalf, email providers need to verify that those emails are legitimate. DKIM (DomainKeys Identified Mail) is one of the key authentication mechanisms that helps with this. Without proper DKIM configuration, emails sent on behalf of your domain are more likely to end up in spam folders.

How to Set It Up

Navigate to the My Domains page and click "Show Advanced" for the domain you want to configure. You'll see the DKIM settings where you can enter your domain name, key selector, and private key.

After saving, the DKIM configuration will be applied to all emails sent from that domain.

The API Still Works

If you prefer to manage DKIM configuration programmatically, the Domain Configs API continues to work as before.

In Conclusion

We hope this makes it easier to ensure your users receive the emails FastComments sends on your behalf. Let us know below if you have any questions.

Cheers!

Tue Feb 17 2026

...

Email Notification Frequency Update

What's New

We've added Reply Notification Frequency and Admin Notification Frequency settings that control how often you receive email notifications for replies and new comments, respectively. The three options for each are:

• Every minute - receive an email as soon as new comments arrive (checked every minute).
• Hourly digest - receive a batched summary of new comments once per hour.
• Daily digest - receive a batched summary of new comments once per day.

Reply Notification Frequency is available to all users and defaults to Every minute. Admin Notification Frequency is available to site admins and defaults to Hourly digest. Note that @mention notifications are always sent right away regardless of these settings.

You can also override the frequency on a per-subscription basis in the Subscriptions table, for fine-grained control over individual pages.

How to Configure It

1. Go to your Notification Settings.
2. Use the Reply Notification Frequency and Admin Notification Frequency dropdowns to set your preferred frequencies.
3. Optionally, override the frequency for individual subscriptions in the Subscriptions table.
4. Click Save Changes.

API Support

The notificationFrequency field on the user object controls reply notification frequency, and the adminNotificationFrequency field controls admin notification frequency. Per-subscription overrides can be set via the subscription's notificationFrequency field. See the API documentation for details.

In Conclusion

This gives users control over their inbox without having to unsubscribe from pages entirely.

Let us know below if you have any feedback!

Cheers!

Mon Feb 16 2026

...

Generated Type-Safe Client SDKs Released

! This Article Contains Technical Jargon

What's New

In our TypeScript migration post, we mentioned that generated client SDKs were coming. They're here.

FastComments now ships official, type-safe SDKs for ten languages:

• TypeScript / JavaScript (npm)
• Python (PyPI)
• Rust (crates.io)
• Go (Go modules)
• Java (Maven)
• PHP (Composer)
• Ruby (RubyGems)
• Swift (Swift Package Manager)
• C++ (CMake)
• Nim (Nimble)

Every SDK is generated from the same OpenAPI specification that our server produces. Types, method signatures, and request/response models stay in sync with the actual API automatically. Your compiler catches field name typos and missing parameters before your code ever makes a network request.

How It Works

The TypeScript migration was a prerequisite for this. Now that our server code is fully typed, we use our fork of TSOA to generate an OpenAPI 3.0 spec directly from our route controllers. That spec is fed into OpenAPI Generator to produce client libraries for each language.

When the API changes, our tooling detects the diff in the spec, regenerates the affected SDKs, runs tests for each language, and opens pull requests automatically. We built a small manager tool in Nim that orchestrates the update-test-release cycle across all ten repositories.

What's in Each SDK

Each SDK provides two API classes:

• DefaultApi: authenticated endpoints that require your API key. Use these server-side for moderation, user management, analytics, and bulk operations.
• PublicApi: unauthenticated endpoints safe to call from browsers and mobile apps. These cover fetching comments, posting, voting, and other client-facing operations.

All SDKs also include SSO utilities for integrating with your existing authentication system. The TypeScript SDK additionally provides real-time event subscriptions for live commenting.

Documentation

Full API documentation is available at docs.fastcomments.com. Each SDK repository also includes generated docs covering every available method and model.

For SSO integration, see our SSO guide. All ten SDKs include SSO helpers using their native cryptography libraries.

In Conclusion

Having a fully typed server made it straightforward to generate a reliable OpenAPI spec, and from there, generating clients for ten (and someday more!) languages was mostly a matter of building the automation and improving our type definitions so they can be consumable, without adding too much abstraction that would slow down FastComments!

Like all major releases, we're pleased that we could take the time to optimize, test, and properly release these SDKs. Let us know below if you have any feedback or if there's a language you'd like us to add.

Cheers!

Sat Feb 07 2026

...

Show Results Breakdown After Answering Questions

What's New

When collecting feedback via Star ratings, NPS, Thumbs Up/Down, or Slider questions, you can now show users an aggregated results breakdown immediately after they answer.

Previously, users would answer a question and simply see their selection highlighted. Now, with the new Show Results Breakdown After Answering setting, they see how everyone else on that page has responded.

What It Looks Like

For Star ratings, the breakdown shows the average rating with partial-fill stars, a per-star distribution bar chart with percentages, and the total response count.

For NPS questions, it displays the NPS score along with Promoter, Passive, and Detractor percentages with color-coded bars.

For Thumbs Up/Down, users see the percentage split between thumbs up and thumbs down.

For Slider questions, the average value and total response count are shown.

Sub-questions each get their own individual breakdown as well.

How to Enable It

1. Go to the Customize UI.
2. Edit your customization rule (or create a new one).
3. Under the question settings, check Show Results Breakdown After Answering.
4. Save.

That's it. The breakdown will appear for users on that page after they submit their answer.

Performance

The breakdown data is aggregated per-page and cached server-side, so it does not add significant load. When a user submits a new answer, the cache is refreshed so the breakdown reflects the latest data immediately.

Dark Mode

The breakdown fully supports dark mode. When your site uses a dark background, the bars, labels, and text colors adapt automatically.

In Conclusion

This feature gives users immediate social proof and context after answering, which can increase engagement with your ratings and surveys. It works with all four question types and requires no code changes to enable.

We hope you enjoy this addition. Let us know below if you have any feedback!

Cheers!

Fri Jan 09 2026

...

Webhook Security Update

What's New

Previously there was extra friction for setting up Webhooks compared to other platforms. We considered this a good thing due to the extra security measures required, however we have recently settled on a mechanism that is just as secure but that security is opt-in.

Previous Behavior

Previously, the system would pass your API key in payloads and expect you to validate it. If you didn't return a 401 for an invalid api key, the system would not allow setup.

New Behavior

Now, the system will not pass an API key for new webhook configurations. Instead, for new and existing integrations a signed HMAC signature is included. You may or may not want to validate this signature, depending on your level of security required.

Existing configurations will continue to pass the API key - you can now request to turn this off via a support ticket.

HMAC Signature Verification

FastComments now sends the following headers with every webhook request:

How the Signature is Computed

1. Concatenate: timestamp + "." + JSON_payload_body
2. Compute HMAC-SHA256 using your API Secret as the key
3. Hex-encode the result

Example Verification (Python)

import hmac
import hashlib
import time
import json

def verify_webhook_signature(headers, body, api_secret):
    timestamp = headers.get('X-FastComments-Timestamp')
    signature = headers.get('X-FastComments-Signature')

    if not timestamp or not signature:
        return False

    # Verify timestamp is recent
    now = int(time.time())
    if abs(now - int(timestamp)) > 300:
        return False

    # Verify signature
    payload = json.dumps(body, separators=(',', ':'))
    message = f"{timestamp}.{payload}"
    expected = hmac.new(
        api_secret.encode(),
        message.encode(),
        hashlib.sha256
    ).hexdigest()

    return signature == f"sha256={expected}"

HTTP Method Selection

Additionally, included with this update - you can now configure the HTTP method for each webhook event type:

• Create Event: POST or PUT (default: PUT)
• Update Event: POST or PUT (default: PUT)
• Delete Event: DELETE, POST, or PUT (default: DELETE)

Security Benefits

The new system has a few benefits:

• Protection against man-in-the-middle attacks
• Replay attack prevention via timestamp verification
• Payload tampering detection

Backwards Compatibility

The token header containing your API Secret is still sent with every request. Existing integrations will continue to work without modification, and as previously mentioned you can request to turn the old behavior off via support.

Documentation

For complete documentation, see our Webhooks Guide.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release these changes. Let us know below if you discover any issues.

Cheers!

Fri Sep 26 2025

...

Two-Factor Authentication (2FA) Now Available

What's New

FastComments now supports Two-Factor Authentication (2FA) support, providing an additional layer of security for your account.

You can now secure your FastComments account using either SMS verification or authenticator apps like Google Authenticator, Authy, or any TOTP-compatible application.

How to Enable 2FA

There is a new "Two-Factor Authentication" button in the Account Details page. The direct link is https://fastcomments.com/auth/my-account/two-factor.

Multiple Device Support

Understanding that users often work across multiple devices, FastComments allows you to register multiple authenticator apps on your account. This means you can have the authenticator set up on both your phone and tablet, etc, up to five authenticators.

In Conclusion

Security is a top priority for FastComments, and we're committed to providing our users with the tools they need to keep their accounts safe. Two-Factor Authentication is now available to all users at no additional cost.

We thank our customers for their continued feedback and trust. We hope you continue to love FastComments.

Cheers!

Wed Sep 10 2025

...

FastComments Is Now Globally Distributed

What's New

Previously FastComments had a very traditional architecture for a web application. We had our app servers, databases, and some other services. This was duplicated across two regions (us-west and eu). If you were in France and wanted to view a comment thread for a customer hosted in our global datacenter, your requests would have to go all the way to us-west for the comment data.

Not anymore! Now comment data and all media assets are replicated globally for customers in our global deployment, and for customers in our EU deployment we have three points of presence in the EU where data is replicated. Your requests go to the closest node in the EU.

How it Used To Work

Except for databases which had several live replicas across regions and cloud providers, all services were deployed on one instance per service type. This meant for each region we had one app server, one pubsub server, and one media server. The plan was to vertically scale while we could as this kept things simple. Writing code was easy - you always knew you could "read your own writes" when hitting the database. Infra was easy, with the exception of security updates which would take a minute of downtime.

The Problem

The problem began obviously when we'd hit capacity. So we'd optimize, and then eventually have to go up and instance size for that service.

This started to become cost prohibitive on Linode, where a $144 instance is about equivalent, based on our passmark testing, of a $20 OVH node, and even if we switched hosting providers we'd have single points of failures all over the place - and providers like OVH tend to have longer resolution times than Linode for maintenance trouble.

RiR :)

For the initial few years the PubSub and Media services at FastComments were written in Java. Java was picked for being relatively high performance for the effort put in, and after years of tuning the GC, trying G1GC, Shenandoah, and Z1, we decided no more Java. The memory usage overhead was simply too much and since these services were very stagnant once complete, the benefits of Java wore off. Also, these services tended to have to deal with the "thundering hurd" problem, which meant the JVM was trying to handle peak traffic when the JIT had not even kicked in yet. These services were prime candidates to switch to C++ or Rust.

Rust was picked since we are not C++ experts and making a mistake in net code could expose one customer's data to another. Rust helps us prevent these kinds of problems.

We wanted to consolidate these services anyway, so while we could have made another pass optimizing them perhaps with GraalVM, we decided to move to Rust and be done with it.

The migration was not without trouble. These services have to terminate SSL, support HTTP 1.1, HTTP/2, and so on. They do things like manage many streams of data concurrently, reading media from an edge on-disk lru cache, S3, databases, and communicating in a mesh. The Java ecosystem, Vertx and Netty, were very good for these things. We are pushing the library ecosystem to its limit, and not having a ton of experience with the Rust libraries meant we had some trial and error. This caused some downtime, and we apologize for that.

We also experimented with different memory managers, settling on mimalloc for our custom DNS servers and libc for the transport layer. We don't run Nginx or Apache, instead using our own combination of a custom DNS server which routes clients globally based an in-memory index rebuilt weekly from Maxmind and our transport layer in Rust which maintains a mesh with the other transport instances. The transport terminates SSL, handles the pubsub work, and is our CDN. The benefit of this is less overhead when moving things between services, and less infrastructure overhead/abstraction. The downside is visibility, so good metrics are important.

In terms of resulting performance, the Rust services used about 10-30% of the memory of the Java ones, despite all of our work. I read books like Java Concurrency in Practice for fun, so while not an expert I know a thing or two about writing fast JVM services, and it was a lot easier to accomplish this with Rust. Additionally, spikes of messages to large numbers of subscribers would barely register on CPU usage when the JVM services would be spending 40% of their time in GC, despite writing our code more like a game engine and less like your typical server. I can't say I'm a huge Rust fan, but for services that do a lot of work and don't change much after initial development, it's perfect. Our main business logic remains in TypeScript.

The New Architecture

The new architecture has no more "pet" nodes. Instead, each server is a complete clone with all the same services and almost identical configuration. They each run the transport, DNS, the application server, and a copy of the database. All nodes maintain Full Disk Encryption with automatic unlocking with Dropbear.

Each server runs the routing transport which terminates requests and handles them as either a websocket, http stream, or cdn request. These servers connect to each other and any given one provide a mapping of the global network to its local DNS server to tell the DNS in real-time where each live node is globally.

One benefit of the new architecture is redundancy. If a customer in one region hits us really hard, the other regions remain online.

The application code now has to be very aware of which queries can hit the nearest node or which have to go to the database primary, which may be far away. Making a mistake can drastically decrease performance. This also means writes from some regions can be slow, and this requires careful tuning and optimization. We now follow a pattern internally in the code where all methods that hit the database take a readPreference argument, so that callers all the way to the top have to explicitly decide how to query.

The benefit is very good horizontal scaling for reads. FastComments is very read heavy, but we must not forget our moderators! Moderators work day in and day out across the globe and we want their experience to remain good. As part of this rollout we've been working with a few of them to ensure the moderation tools remain fast.

We can also hand-select hardware, which is fun and rewarding. The new servers are a mix of i5-13500 and Ryzen 5 5600X boxes, and EU is on some older Xeons. In our benchmarks all of these were much faster than the more expensive servers we were exploring on other providers. The downside is more setup work, but we have automated this, along with SMART disk monitoring for failures and so on.

Doing these kinds of things means we can continue to offer competitive pricing.

The Rollout

The rollout over the past couple months as we rewrite the services and move to new hosting providers has been bumpy, we thank you for your patience.

On the initial rollout our metrics showed us an increase in requests taking > 100ms. We try not to have many requests taking this long for anything.

Gradual Progress

We are still making gradual progress improving performance for some regions. Thanks to everyone which has provided feedback thus far.

Considerations When Using The API

The API remains strongly consistent - you can read your own writes - to maintain backwards compatibility and keep things simple for developers. To allow developers to choose performance over consistency we plan to expose the readPreference parameter. The benefit is we may also offer a credits discount for these API calls.

All the public endpoints, like for serving the public comment widget, always read from the nearest (local) database on that node.

Why Not Just Use a Regular CDN

The comment thread are not static, they are live, and applying a live stream over the stale static data also does not work as when you view a thread as an anonymous user you get an "anonymous session". In this anonymous session you can do things like block and flag other users, and you have to show if the anon user liked a given comment, and so on. Comment threads can also be locked behind SSO, authentication, or user groups.

Finally, the kind of "progressive enhancement" where the dynamic data is mapped to the static data from the CDN gives you a bad experience where content jumps around or changes after a few seconds. We would prefer not to do that.

Who Has My Data Now

Your data is no longer stored on Linode. It's replicated live between Hetzner and OVH with full disk encryption, and all communication between backend servers is done with TLS. We maintain a couple legacy Linode instances for outbound webhook proxies, but no data or media remains stored on Linode.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this change. FastComments should scale better and have better uptime in the long run with this work. Let us know below if you discover any issues.

Fri May 23 2025

...

Image Uploading Improvements

What's New

Today a series of bugfixes have been released for image uploading and the WYSIWYG (what you see is what you get) editing mode.

1. Progress indication is now showed when uploading images.
2. Pasting images, like screenshots is now supported (WYSIWYG editor only).
3. When editing comments, the comment boxes are now properly sized to show all the images (WYSIWYG editor only).
4. When removing images, the comment box shrinks as expected (WYSIWYG editor only).

In Conclusion

Thanks to our patient customers who brought up some of these issues. We hope you continue to enjoy working with FastComments.

Fri May 23 2025

...

Webhook Events Can Now be Canceled

What's New

Previously, cancelling webhook events was done via a support ticket. They can instead now be canceled self-service by going to the logs page and clicking the x next to the event.

Additionally, the webhook logs UI has been made much faster.

In Conclusion

We hope you found this update helpful and continue to enjoy working with FastComments.

Sun Apr 20 2025

...

Users Can Now Reorder Their Badges

What's New

A long-standing ask for power users of FastComments is that they could re-order their badges. Users can be automatically awarded badges, and some sites have many and many different types. When showing 20 different badges on each comment, with some being image badges and some being text, showing them in the awarded order is not always desirable.

Now, by hovering over your account name in the top right of your dashboard and selecting Manage Badges, you can select which badges are active as well as re-order them. New badges will still be added onto the end.

In The Future

In the future we will be revamping the user profile UI, and the new reorder component will replace the existing "Select Badges to Show" UI in profiles.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!

Wed Apr 09 2025

...

Image Content Moderation With FastComments

FastComments now supports blocking images based on their content.

Images uploaded to comment sections can now be automatically filtered based on different profanity levels. This gives you more control over what appears in your community's discussions.

You can choose from four different moderation levels:

• Off: No moderation (default)
• Low: Blocks explicit sexual and violence content
• Medium: Also blocks hate, harassment and self-harm content
• High: Additionally blocks mild suggestive content

This feature works for all newly uploaded images across all comment sections on your site, providing consistent moderation without requiring manual review.

Documentation

You can find the docs here: https://docs.fastcomments.com/guide-customizations-and-configuration.html#image-content-moderation.

Happy Commenting!

Fri Feb 28 2025

...

Migrating Reactions From Hyvor Talk Is Now Supported

What's New

When you import comments to migrate them from Hyvor Talk, FastComments can now import your page reacts. Additionally, we'll detect if comment threads on pages are closed or not, and migrate that status as well.

Re-running the import will not cause counts to duplicate or lose any reaction values from before the import.

How to Set Up Reactions

Page reacts showing is not automatic. To get started, you'll have to update your widget configuration:

<script src="https://cdn.fastcomments.com/js/embed-v2.min.js"></script>
<div id="fastcomments-widget"></div>
<script>
    FastCommentsUI(document.getElementById('fastcomments-widget'), {
        "tenantId": "demo",
        pageReactConfig: {
            reacts: [
                {id: 'superb', src: 'https://raw.githubusercontent.com/hfg-gmuend/openmoji/master/color/618x618/1F929.png'}, // Star-Struck
                {id: 'love', src: 'https://raw.githubusercontent.com/hfg-gmuend/openmoji/master/color/618x618/2764.png'}, // Red Heart
                {id: 'wow', src: 'https://raw.githubusercontent.com/hfg-gmuend/openmoji/master/color/618x618/1F62E.png'}, // Face with Open Mouth
                {id: 'sad', src: 'https://raw.githubusercontent.com/hfg-gmuend/openmoji/master/color/618x618/1F622.png'}, // Crying Face
                {id: 'laugh', src: 'https://raw.githubusercontent.com/hfg-gmuend/openmoji/master/color/618x618/1F602.png'}, // Face with Tears of Joy
                {id: 'angry', src: 'https://raw.githubusercontent.com/hfg-gmuend/openmoji/master/color/618x618/1F620.png'}  // Angry Face
            ]
        }
    });
</script>

The ids must match the ones from the Hyvor Talk export. This example uses the correct values.

You'll have to source your own reaction images. They can be any format, including gifs. The above example uses some from the OpenMoji project.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!

Sat Feb 22 2025

...

New Aggregation API Released

! This Article Contains Technical Jargon

What's New

FastComments gives its customers unbeatable access to their data with a flexible aggregation API. This API lets you count, investigate, slice, and aggregate your comments, votes, and 34 more resources!

Example - Counting Comments by Email and Page

For example with the new API we can get a count of comments by page (urlId) and user email (commenterEmail):

This would give us something like:

Or maybe we want to count our approved and unapproved comments:

Gives us:

The API also supports query filters and more in-depth grouping.

Documentation

You can find the full documentation here.

Motivation

We want our customers to be able to build dashboards to monitor their account, build reports, handle customer requests, and investigate their data as needed.

Who Gets it & Limits

All FastComments customers have access to the API. Your usage is limited based on your available API credits which will vary based on the package you've purchased.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release these changes. Let us know below if you discover any issues.

Cheers!

Fri Jan 31 2025

...

FastComments TypeScript Migration Completed

! This Article Contains Technical Jargon

What's New

At FastComments we value statically typed languages. More specifically, I like decent type systems with fast compilers. FastComments we started with the latter - or no compiler. While we had two services written in modern Java within the first year, the main backend and frontend libraries were written in CJS JS running on Node.

In preparation for the next decade of development, we've migrated the largest FastComments components to TypeScript.

This involved migrating over 130k lines of code (100k of that is backend) across 1441 files, and fixing over 8000 compile errors.

woooooo

This was done over two weeks.

Code Freeze - Thank You

I would like to thank our customers for dealing with any delays in bugfixes or feature releases as we did a two week code freeze to complete this upgrade. Thank you!

Bugs Fixed

As you can imagine, we fixed a handful of bugs. These were mostly around spam detection and caching.

Breaking Changes

• All API endpoints now return status: 'failed' instead of a mix of "failed" and "failure" as status values. "success" remains unchanged.
• We will no longer default to the first widget configuration if there is no match, instead we will return the default system configuration.

What Was it Like?

We found that, as usual, many of the tools in the NPM ecosystem to help with this task did not work very well. So, we used LLMs to generate scripts to do a lot of the work. For example, we made heavy use of JSDoc, so we could write scripts to take the JSDoc and convert them to typescript interfaces and type definitions, and properly annotate function arguments and return types. We also used these scripts to migrate from CJS to ESM, which included rewriting imports, exports, and detecting common runtime issues like __dirname.

Did I mention runtime issues?

How is TypeScript in 2025?

TypeScript is a nice language for writing business logic. But, Java still has better DevEx. If Java, Go, or Rust compiles, most likely it will work. With TypeScript, I can do something like:

console.log(__dirname);

... and this will compile.

But it won't run, with modern es modules. Your IDE will happily even autocomplete __dirname, and then it will blow up at runtime. It feels like Spring DI, but worse.

You can also do things like:

context.someImportantMethodToCall;

Now, this is a "statement". It's a valid "statement". At first glance you might think we're calling someImportantMethodToCall, but we're not! My IDE, at least, doesn't warn about this, and neither does the compiler. The code will just do nothing (unless someImportantMethodToCall is a class getter in which case it is implicitly called...)

The fix is:

context.someImportantMethodToCall();

I think you can probably detect this with something like eslint and some "no no side-effects" rule, but then you pull in another large set of libraries to keep updated, and then eslint has to parse your whole code base on every build, the tools are slow, and so on - no thanks. The productivity impact of dealing with slow tools like eslint has been more significant in my career in past jobs than the productivity "boost" I ever got from the minor things eslint fixes/prevents with spacing etc. There are faster alternatives coming out now, which is great.

TypeScript is really nice because of language features like Pick<User, 'username', 'email'>. This, combined with type inference, provides a way to have type-safe query results from the database for subsets of larger objects without having to define a class for each shape. Pick is something I'm surprised Scala doesn't have. Type Unions are also really nice.

Incremental builds also work reasonably well, we've only increased our build times in CI by about 5 - 10 seconds on average, for building the shared library, frontend, and backend.

Development Timeline

For those curious, here's what our progression looked like:

• Day One: Found 5564 errors in 362 files.
• Day Two: Found 4034 errors in 239 files.
• Day Three: Found 3784 errors in 191 files.
• Day Four: Found 2974 errors in 169 files.
• Day Five: Found 3000 errors in 171 files.
• Day Six: Found 2916 errors in 165 files.
• Day Seven: Found 2618 errors in 157 files.
• Day Eight: Found 2253 errors in 109 files.
• Day Nine: Found 1605 errors in 69 files.
• Day Ten: Found 686 errors in 53 files.
• Day 11: Backend Unit Tests Pass
• Day 12: Start to migrate frontend, 3118 errors.
• Day 13: Found 2172 errors.
• Day 14: Found 1224 errors.
• Day 15: Found 498 errors.
• Day 16: All compile errors fixed.
• Day 17: Released. E2E tests pass. 30 minutes downtime during unexpected runtime issues. :)

The Future

We did this to support development for the next decade. The system is now large enough that it's faster to develop with a type system than without one.

You can also expect our TypeScript library on NPM to improve, as it already has started to, since we're now dog-feeding that library in our server and client code.

We will also soon be releasing generated client SDKs directly from the server code, which was a primary motivation around this effort.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release these changes. Let us know below if you discover any issues.

Cheers!

Wed Nov 06 2024

...

FastComments Affiliates Program Re-Launched

What's New

FastComments now has a completely self-hosted affiliate program to improve conversion rates and reliability.

Previous Provider

FastComments previously had an affiliate program through a provider called Rewardful. We began to be concerned about the conversion rates through this program, and realized that ad blockers were impacting this integration.

Obviously this is a big issue, because most people use an ad blocker nowadays.

According to Rewardful, the program was properly working, but to make it work we could pay them more money. It was not unaffordable, but we found the way they dealt with this problem and did not include the features necessary to make it work on all tiers of their platform to be unacceptable. So, we quickly cancelled this partnership. Any FastComments customer data that was in Rewardful should now be deleted at our request.

The New Dashboard

When you view the affiliates dashboard for the first time you will see this:

Clicking Create Affiliate Link will take you through the flow of creating your link and specifying your PayPal email for payouts.

Impact to Existing Affiliates

Existing affiliates have already been migrated to the new system. If you had an account, you can view your affiliate stats in the affiliates dashboard. Payouts have been resumed on the normal schedule.

Benefits of Running it Ourselves

Now that we run the affiliate program on our own tech stack we don't have to worry about ad blockers or other issues.

We can also provide much more detailed stats around conversions. We can also customize this reporting experience over time without being beholden to another provider.

Documentation

You can find the full documentation here

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this. Let us know below if you discover any issues.

Cheers!

Mon Aug 26 2024

...

FastComments Can Now Show Comment Viewed Counts

What's New

FastComments now supports showing a count next to each comment that increments live as users view comments. Whether a comment is viewed or not is determined by the user's account or anon session. It supports SSO (both Secure SSO and Simple SSO).

Live Demo

We've enabled a comment view counts for this blog post specifically! Check the count next to the eye on each comment!

Documentation

You can find the developer documentation for setting up View Counts here.

Performance

Counts are not immediately updated, there is a small (up to three second) delay as counts are aggregated and then sent over the network. This is an optimization so that if you have a live event, and a few thousand people view say 10 comments on average on the page, we don't instantly send millions of updates (3000 users x 3000 page loads = ~9 million changes) to every user and bog down their browser or use all their network bandwidth.

In Conclusion

We thank our customers that give us continuous feedback so that we can think of ideas like this and also give us the time to launch well optimized features. We hope you continue to love FastComments.

Cheers!

Fri Aug 23 2024

...

Page Reacts Launched

What's New

FastComments had already supported what we call our Feedback module, where you could display a start rating, NPS, or other question above the comment area.

However, many users want something simpler - to show some icons with some reactions above the comment widget, to be able to customize those icons, maybe customize the options per-user, and so on.

As of today we have launched this feature.

All FastComments plans now have access to Page Reacts.

Live Demo

We've enabled a demo Page Reacts config for this blog post specifically, you can find it below!

Documentation

You can find the developer documentation for setting up Page Reacts here.

React User List

Page Reacts can also be configured to show a tooltip that reveals the list of users that left a specific reaction.

In Conclusion

We thank our customers that give us continuous feedback so that we can think of ideas like this and also give us the time to launch well optimized features. We hope you continue to love FastComments.

Cheers!

Fri Jul 26 2024

...

Spoiler Support Added

What's New

Users of FastComments can now click a "SPOILER" button to add spoilers to their comments. They can also write <spoiler>some text</spoiler> tags directly if desired. Note that the toolbar option for spoilers is disabled by default.

Turning On Spoilers

In Widget Customization you can simply enable the Spoilers option and hit save. Docs are here. We've enabled them for this blog post to demo the feature.

For Developers & Gotchas

The default spoiler styling supports light and dark modes. If you write custom CSS for masked text remember to cover dark mode as well if your site supports it.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!

Tue Apr 16 2024

...

The FastComments WYSIWYG Editor is Out of Beta

What's New

Users of FastComment always had the ability to format their comments with anchor tabs like <b>this</b>. This is very familiar to anyone who has used an internet forum in the past, or many of our competitors, however some users and communities expect different behavior.

You can now style text in the comment area without anchor tags, as the text input can be switched to a contenteditable.

For demonstration purposes this has been enabled on this blog.

The advanced editor has the exact same appearance as the old editor, it just doesn't use visible anchor tags.

Turning On Advanced Editing

In Widget Customization you can simply enable Advanced Editor and hit save. Docs are here.

For Developers & Gotchas

You can find documentation for enabling this in code here although we recommend using the Widget Customization UI as it will result in less data sent round trip per page load.

The generated HTML from the content editable is slightly different than the old textarea editor, so keep this in mind if you are parsing comments from the API.

Optimizations

We kept the comment widget from growing with this new feature by adding this as an extension which is loaded in the background when this feature is enabled, which keeps the default comment widget small and light.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!

Wed Mar 06 2024

...

Languages Used in Comments Can Now Be Limited

What's New

FastComments has always tried to support as many languages and locales as possible.

However, some communities want to limit the languages used to communicate and write comments.

Instead of enforcing this as a rule, and potentially banning users, it can now be explicitly configured in the platform.

How to Set it Up

In the same Widget Customization UI you are probably familiar with, you can now select one or more languages that comments can be written in.

The platform will, upon comment submission, attempt to determine the comment language in real time. If the confidence of the determined language is over 70%, and it matches with an allowed language, then the comment is allowed.

If the written comment is not in a language defined by your configuration, the user will be shown an error message in their own language.

Developer Impact

This configuration will impact comments saved via the API as well.

You will receive an error like the following:

        status: 'failed',
        reason: `Comment looks like it's one of these languages: [es], but only [en,fr] are allowed.`,
        code: 'language-not-allowed',
        translatedError: "An error message in the user's language."

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!

Mon Jan 08 2024

...

Password Authentication is Now Supported

What's New

Since launch FastComments authenticated via magic email links. This was because we could consolidate our login mechanisms into the same system used for when a user leaves their first comment and verifies/logins via an email-based link. However, not all email servers are the same, and sometimes receiving a link could take minutes. This was very frustrating for some of our users.

As of late 2023 FastComments now supports authenticating via passwords! On the login page there are now two tabs - one for logging in via email and one for via password.

How to Set a Password

You can set a password by going to My Account -> Account Details -> Change Password.

Simply request a reset link. A link will be sent to your email, and upon clicking this you will be able to set a new password. The link only works once and expires if not used.

Password Storage & Security

Password are not stored. Rather, passwords are hashed with an 11-round salt using bcrypt. Concurrency to the password based system is limited and monitored to prevent various types of password related attacks.

The Future

In the future we plan to support 2FA as well.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!

Mon Dec 11 2023

...

Tenant Management Update

What's New

As of December 11th 2023 FastComments now features the ability to switch tenants without impersonating other tenant users.

Target Audience

This update is not for commenters or site administrators that run a single site. This benefits admins that run many sites or tenants only.

Impact to Admins

Previously, creating tenants and switching users was a pain. Some common pain points where:

1. You had to create a user when creating your tenant, as that user "owned" the tenant.
2. This meant you had to use a new email for every site, even if you wanted to use one email/account for many sub-tenants.
3. Switching tenants required impersonation, meaning that your users had to be duplicated across all tenants, with the same permissions, and so on.

Now:

1. No user creation is required when creating a tenant.
2. Any Super Admin user with the appropriate permissions has the same permissions in all sub-tenants.
3. There is a Switch button in the tenants list which retains your current user and permissions, but changes what tenant you are logged in to.
4. If you're an administrator of a parent tenant, you have moderator permissions in sub-tenants when using the comment widget.

Events are still logged in Audit Log for the tenant you are switched to.

Impersonation

You can still impersonate users. Switch to a tenant and go to the Users page.

For Developers & Gotchas

When using the POST /tenants API, the email field is now optional. The documentation has been updated.

Future Updates

In the future there will be some more administrative actions in the tenants list, like deleting tenants and so on.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!

Mon Nov 27 2023

...

Releasing Display Names

What's New

FastComments always supported display names for SSO users. However, this was never exposed to regular commenters. Today changes that!

In the Account Details page you can now fill out a new Display Name field. Display Name will be shown on your comments and your profiles.

Emojis

In the past, users had difficulty using emojis in usernames as you need to enter your username to login. However, now Display Name may contain emojis.

Uniqueness and Abuse

The point of Display Name is that it is not unique. If two FastComments.com users, on two very different major communities both have similar names, then we'd like them to just be able to set their preferred display name. However, we can't restrict where people comment with their global FastComments account, so sometimes this may result in confusion.

Having a similar name to another user, or a moderator, by itself is not a case for abuse. However, if you abuse this by intentionally impersonating other users, we may disable this feature on your account, and you will be limited to just using username.

Logging In

You still use your username to log in - not your display name!

For Developers & Gotchas

The regular User objects exposed via the API now have displayName.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!

Thu Nov 16 2023

...

Announcing FastComments Trust Factor

What's New

As of November 16th 2023 FastComments has begun expanding how it determines the trustworthiness of users to reduce frustration of dealing with spam filters.

Impact to Users

If you're a long time member of an existing site, and you have had your comments caught by the spam filter, this change is for you.

We've had numerous reports of users on sites that do things that spam filters do not like, like sharing lots of links and so on, and these comments end up in spam and are either blocked or await moderator approval depending on the site setup.

Impact to Site Admins and Moderators

1. You might see fewer comments automatically marked as spam from your most active users.
2. This does not change spam detection based on the word/phrase blacklist. Profanity and filtered phrases will still cause comments to go to spam if you have this setup.

The Trust Factor number itself is not currently exposed to site admins or moderators, however this is something we will explore in the future.

How Trust Factor is Calculated

Trust Factor is a number from 0 to 100 and is maintained on a per-site basis.

The following variables are used to determine trust factor:

• Age of interaction with the site.
• Number of approved comments.
• Number of pinned comments.

If you have been a member of a site for over six months, and you've left over approved 50 comments, you will have a perfect trust score of 100.

Otherwise, the formula is as follows and will evolve over time:

min((timeFactor + commentFactor + pinFactor) / 3, 100)

Where:

timeFactor = 100 * TimeSinceFirstComment / SixMonths
commentFactor = NumberOfApprovedComments
pinFactor = NumberOfPinnedComments * 20

You may notice the * 20 here - pinned comments have a high weight. If moderators are pinning your comments, you are likely considered a fairly trusted user.

For Developers & Gotchas

In the API, UserBadgeProgress now has autoTrustFactor and manualTrustFactor exposed.

autoTrustFactor is calculated by us and is not writable via the API.

If you'd like to configure trust factor yourself you can define manualTrustFactor. The system will then use this value instead, and we will continue to maintain the autoTrustFactor value separately.

Abuse of Trust Factor

Like all things we expect this to be abused. People will build up relationships with a community and then use the account to post spam. However, we think with sensible defaults (six months, 50+ comments), we set the bar high enough to make this not worth it for most spammers. Once they start posting spam their account can be immediately banned by moderators. In the future we may also let moderators adjust the trust factor.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!

Tue Nov 14 2023

...

Webhook Structure Changes

What's New

Before November 14th 2023, we have made the following changes to webhooks:

Update Webhooks

Previously, updates would contain the latest version of a comment. If two users voted a comment in quick succession, this would trigger two webhooks. However, it was possible for the first webhook event to contain the latest version, resulting in two identical webhook events:

1. ... { votes: 2 } ...
2. ... { votes: 2 } ...

As of Nov 14th each webhook event is idempotent and contains the comment object at the time of the change. In the above example you will now get two events:

1. ... { votes: 1 } ...
2. ... { votes: 2 } ...

Delete Webhooks

Previously, delete webhooks only contained the comment id. This was an object like { id: string }.

As of Nov 14th, delete webhooks will contain the entire comment object at the time of removal.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!

Fri Nov 10 2023

...

Seamless Dark Mode Switching Added

What's New

FastComments always supported dark mode. However, it used to require a reload of the comment widget to switch to dark mode.

This means that if a site used dark mode, or allowed users to switch back and forth between light and dark modes, we would completely remove the comment widget from the browser and reload it. This was done for technical reasons to simplify the product on initial launch since state has to be communicated back and forth between the parent page and the widget's iframe.

In light of spooky season being over - the dark mode switch has been improved. The comment widget now supports seamless transitions between light and dark modes. However, it still requires passing the hasDarkBackground flag when applicable.

For Developers & Gotchas

To tell the comment widget that your site is in dark mode - or has a dark background applied - you would pass the hasDarkBackground flag. This does not change. However, now when you call instance.update(newConfig) (or change state in one of our libraries like React, Svelte, etc), we will detect if the only changed parameter is hasDarkBackground and if so gracefully update the comment widget. The widget will asynchronously load the dark mode extension in the background and update its styling if necessary.

One major gotcha is that when you pass newConfig - this must be an entirely new object for this feature to work.

In Conclusion

Like all major releases, we're glad that we could take the time to optimize, test, and properly release this feature. Let us know below if you discover any issues.

Cheers!