WordPress privacy leak checker: who can read your commenters’ identities?

Comment forms post to wp-comments-post.php, not to this route, so comments keep working. Logged-in users and the block editor keep the route. Add to a child theme or a snippets plugin:

add_filter('rest_endpoints', function ($e) {
  if (!is_user_logged_in()) {
    unset($e['/wp/v2/comments'], $e['/wp/v2/comments/(?P<id>[\d]+)']);
  }
  return $e;
});

Without a plugin, point every avatar at one image on your server and drop the author from embeds. Gravatar pictures disappear; the hash disappears with them.

// One local image for every avatar: no hash leaves your site.
add_filter('get_avatar_url', function ($url) {
  return get_stylesheet_directory_uri() . '/assets/avatar.png';
});
// And strip the author from embeds of your posts.
add_filter('oembed_response_data', function ($d) {
  unset($d['author_name'], $d['author_url']);
  return $d;
});