It appears that looping through wp_comment_query() with the argument post_status set to publish also lists comments that are posted on password protected posts.

Is this the correct behavior or is this a bug? How can I avoid looping through comments submitted to password protected posts?

I checked through the database wp_comments table and there doesn't seem to be a relevant entry to play with.

Using the Query Monitor plugin, I was able to inspect the SQL query:

FROM wp_comments JOIN wp_posts
ON wp_posts.ID = wp_comments.comment_post_ID
WHERE ( comment_approved = '1' )
AND wp_posts.post_status IN ('publish')
AND wp_posts.post_type IN ('post')
ORDER BY wp_comments.comment_date_gmt DESC

To clarify the problem, as it stands, if you use wp_comment_query() to display comments (for example in the front-end), then comments that were posted on password protected posts are looped through.

  • Could you post the code that queries your comments, as well as the resulting SQL statement?
    – kovshenin
    Jul 29, 2015 at 19:16
  • so $comments = WP_Comment_Query( array( 'post_status' => 'publish' ) ); give you comments to private posts? Could you post the resulting SQL query?
    – kovshenin
    Jul 29, 2015 at 19:24
  • You can do it with a plugin like Query Monitor or the Debug Bar series.
    – kovshenin
    Jul 29, 2015 at 20:05
  • Yeah, so that query makes sure comments are taken for published posts only. Why do you think it's returning comments for private posts as well? Can you print_r the returned set and check the post ID's against the database posts table?
    – kovshenin
    Jul 30, 2015 at 19:43
  • @kovshenin It appears this issue is related to password protected posts, not private posts. That was my mistake. You can test this behavior as well. Simply create a password protected post, post a comment with a specific user and run the following by adding the $user_id... for example: $comments = WP_Comment_Query( array( 'post_status' => 'publish', 'post_author' => $user_id ) );
    – Christine Cooper
    Jul 30, 2015 at 22:47

1 Answer 1


It's not a bug (gasp!) really just not provided for. You have to add a filter to do this, eg

add_filter( 'comments_clauses', function ( $pieces, $query ) {
    if ( empty( $query->query_vars['wpse_no_password'] ) ) return $pieces;
    global $wpdb;
    $pieces[ 'where' ] .= $wpdb->prepare( ' AND ' . $wpdb->posts . '.post_password = %s', '' );
    return $pieces;
}, 10, 2 );

$args = array( 'post_status' => 'publish', 'wpse_no_password' => 1 );
$query = new WP_Comment_Query( $args );
  • This is great bonger! IMO this behavior should be considered in core because comment entries in password protected posts should essentially be hidden (private) from a loop unless otherwise requested.
    – Christine Cooper
    Jul 31, 2015 at 14:02
  • 1
    You have a point, though a quick scan of trac reveals a backend bug core.trac.wordpress.org/ticket/25338 that was downgraded to an enhancement (and then slid into the usual trac pit of endless silence...)
    – bonger
    Jul 31, 2015 at 16:13
  • You have some amazing skills finding things in trac. I should invest time searching there prior to asking here. Thanks again!
    – Christine Cooper
    Jul 31, 2015 at 23:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.