---
title: Comments
description: Self-hosted comments for your Astro sites, stored in the CMS database.
---

Comments, commenters (name, email, picture), likes, bans and the moderation log live in Gitupcms's own SQLite database. Nothing goes to a third party except the commenter's sign-in (Google or GitHub) and the emails you set up. Commenters' emails are never sent to the site.

## Install

**Astro**

**Comments → Install** commits `src/components/GitupcmsComments.astro` (or opens a review). Put it where comments go; each page gets a thread keyed by its path.

```astro src/layouts/Post.astro
---
import GitupcmsComments from "../components/GitupcmsComments.astro";
---
<article><slot /></article>
<GitupcmsComments />
```

**Plain HTML**

```html
<div data-gitupcms-comments data-site-key="…"></div>
<script async src="https://app.gitupcms.com/comments/embed.js"></script>
```

The widget renders in a shadow root, follows `html.dark` (or a forced theme), and works with Astro view transitions.


The same comments run on their own server as [Gitupcms](https://github.com/gitupcms/gitupcms-comments), the open-source, self-hosted version.

## Commenter sign-in

Commenters sign in with Google or GitHub in a popup. They are separate from CMS users.

- Each site can add its own OAuth apps under **Comments → Settings → Sign-in** (stored encrypted). The callback URL is shown there.
- Otherwise the server's apps are used: `COMMENTS_GOOGLE_CLIENT_ID` / `_SECRET` and `COMMENTS_GITHUB_CLIENT_ID` / `_SECRET`.

## Where comments may come from

**Settings → General** sets the site domain and allowed origins (`*.example.com` wildcards work). Every write checks the page origin; posts are rate limited per IP.

## Moderation

Editors and above get:

- an overview with 30 days of activity;
- comments by page and status, with bulk approve, spam and remove, edit and history;
- users, with ban, remove-all and email mute.

Removed comments keep their place in the thread, not their words. Settings, email, install, export and delete-all are for admins.

## Email

New comments go to the address you set; replies and @mentions to their authors; likes up to a limit. Each email has an unsubscribe link. Mail goes through the site's own SMTP server (**Settings → Email**, password encrypted) or the CMS's email.

## Your data

**Settings → Your data** exports everything as JSON, or deletes it all.