Isso

Last reviewed Sep 13, 2026 · 837 words

Comments on a static site cost one container, about 128 MB of RAM and a single SQLite file, and Isso has been the way to get them since 2012. You add a script tag and a div to your templates, point it at a Python service behind your reverse proxy, and readers get a Markdown comment box with no Disqus tracking, no third-party cookies and no account. The reason to read past this paragraph is spam: Isso's own anti-spam is thin, and the settings that keep a public comment box civil are three lines in a config file that most people never open.

Twelve lines of integration

The whole embed is a script tag and an anchor element in your page template:

<script data-isso="https://comments.example.com/"
        src="https://comments.example.com/js/embed.min.js"></script>
<section id="isso-thread" data-title="Your post title"></section>

Isso keys threads on the page's path, so it works with Hugo, Jekyll, Astro or anything else that renders HTML; there is no plugin to install. Comments render inside the section, replies nest one level, and authors can edit or delete their own comment for a window you set. The widget is small (well under 100 KB) and the server is MIT-licensed Python at 5,305 GitHub stars.

The config that matters

Run it from the official image and mount a config file and a database directory:

services:
  isso:
    image: ghcr.io/isso-comments/isso:release
    volumes:
      - ./config:/config
      - ./db:/db
    ports:
      - "127.0.0.1:8080:8080"
    restart: unless-stopped

Then the file at config/isso.cfg. The [general] block must set dbpath = /db/comments.db and host = https://example.com with the exact origin of your blog; a mismatch here is the number-one cause of "the box appears but posting fails", because Isso uses the host list to decide which origins it will accept comments from. Set notify = smtp and fill the [smtp] block so you hear about new comments. In [moderation], enabled = true holds every new comment until you approve it from a link in the notification email. In [guard], enabled = true, ratelimit = 2 and direct-reply = 3 cap how many comments one IP can post per minute and how many top-level comments it can leave on one thread. Those two blocks are the whole spam strategy; leave them at defaults and a public blog will collect casino links within a week.

Spam: what "minimal" actually means

There is no Akismet, no CAPTCHA and no honeypot field built in. What you have is the rate limiter, require-author and require-email under [guard], and moderation. My experience on a mid-sized technical blog is that moderation-on plus the rate limiter reduces the problem to a handful of junk comments a month arriving in email, which is fine. If you would rather have automated filtering, Remark42 is the bigger project in this niche with social login and better anti-abuse tooling, at the cost of a Go binary with more moving parts. Cusdis is the other lightweight option and is moderation-only by design.

Reverse proxy detail people trip on, and the one-file backup

Serve Isso on its own subdomain or under a path such as /isso/ on the main site. Under a path, the [server] block needs public-endpoint = https://example.com/isso so the embed script requests the right URL, and your proxy must pass the path prefix through unchanged. A Caddy block of handle_path /isso/* { reverse_proxy isso:8080 } does it; the reverse proxy showdown covers the Traefik and NPM equivalents. Same-origin serving also sidesteps the browser tracking-protection features that block third-party cookies, which Isso relies on for the edit-your-own-comment feature.

Backups are one file: everything is in comments.db. A nightly sqlite3 /db/comments.db ".backup /backups/isso-$(date +%F).db" is the entire backup plan, and the restore is copying the file back. Isso also ships an import command for Disqus and WordPress XML exports, so moving off Disqus keeps your history: isso -c isso.cfg import disqus-export.xml runs against the same config and writes into the same database.

Isso against the alternatives

What I'd do

Isso, moderation on, guard on, SMTP configured, served under a path on the blog's own domain. It is the smallest thing that does the job, it has 14 years of history, and the database fits in an email attachment. If your site draws enough traffic that you are approving 20 comments a day, or you want readers to log in with GitHub, move up to Remark42; below that, Isso is the right size.