# Comments on your site

Comments let the people reviewing a site point at the exact thing they mean. They open the site, press
`C`, click a heading or select a sentence, and write. The comment stays pinned to that spot, everyone
else reviewing the site sees it appear without reloading, and you get an email.

Nothing is added to your files. The comment layer is put on top of your pages as they are served, so the
folder you publish is the same with comments on or off, and turning them off removes the layer on the
next page load.

## Turn comments on

Comments come with some plans. On a plan without them, the choices below are shown disabled with a link to
the plans that have them. Open the site in the dashboard, go to **Sharing**, and under **Who can comment**
pick one of three.

**Nobody** — no comment layer on the site.

**People you invite** — for a private review.

1. Make the site **invite-only** and add the people who should see it.
2. Choose **People you invite**.
3. For each person who should comment rather than only look, set their role to **Can comment**. People
   you add with this role get an invitation to review the site instead of one to view it.

This choice only takes effect while the site is invite-only.

**Anyone signed in to dropto.run** — for a prototype you show in public. The site stays as open as it is,
with or without a password, and anybody with a free dropto.run account can comment on it.

- Visitors who are not signed in see how many comments the page has, and a **Comment with Drop2Run**
  button. Nothing else: no pins, no comments, no names.
- That button signs them in on dropto.run and brings them back to the same spot. The first time on each
  site, they are asked to confirm that their name will be shown to everybody signed in who views it.
- On a password-protected site they need the password as well — signing in to comment does not get
  anybody past it.
- On an invite-only site, this choice means everybody on the list can comment, whatever their role.

You can comment on your own site too, from the same overlay. Open the site from the dashboard, or from
any comment's **View** link.

## Writing a comment

| Key | What it does |
|---|---|
| `C` | Turn comment mode on or off. In comment mode, clicking pins a comment to what you clicked. With text selected, comment on that text instead |
| `Esc` | Close the open thread, menu or comment mode, one step at a time |
| `Shift+C` | Hide the comment layer entirely, for looking at the page as visitors see it |

Shortcuts are ignored while you are typing in a field on the page.

There are two ways to pin a comment:

- **Click an element** — a heading, an image, a button. The pin stays on that element.
- **Select some text**, then press the comment button that appears over it — or press `C`, which does the
  same when another popup (a translator's, a dictionary's) covers the button. In comment mode, selecting
  words opens the comment box straight away. The comment remembers the words, so it stays attached to the
  sentence even if the page around it moves.

The sidebar lists the comments on the current page or across all pages, open or resolved. A comment pinned
to something hidden right now — a closed menu, an inactive tab — is listed under **Not visible right now**.
One whose element or text is no longer on the page, on this version or an earlier one, is listed under
**Outdated**.

On a phone, comments open as a sheet from the bottom of the screen, where you can read every thread and
reply. New comments are pinned from a computer: placing a pin needs a pointer.

## Who sees what

- People with **Can comment**, and you, see every comment on the site and can reply to any thread.
- Everyone can edit and delete their own comments. A commenter can resolve the threads they opened. You
  can resolve and reopen any thread, and delete any comment.
- People with **Can view** see the site without the comment layer.
- Comments show a display name — the account's name, or the part of the address before the `@` when it
  has none — and never an email address. You see commenters' addresses in the dashboard. On a site open
  to anybody signed in, that name is seen by everybody signed in who views the site.

Taking somebody off the list, or changing them to **Can view**, stops their access to comments at once:
even a tab they already have open is refused the next time it reads or writes.

## Blocking somebody

On a site open to anybody signed in, open one of their comments, choose **⋯**, then **Block … from
commenting**. You can keep what they wrote or delete all of it. They can still read the comments; they can
no longer write, starting with their next request. The **Feedback** tab lists everybody you have blocked,
with their address, and **Unblock** lets them back. Comments deleted with a block stay deleted.

Somebody blocked by the owners of several sites in a short time is looked at by us as well.

## The Feedback tab

Every site with comments has a **Feedback** tab in the dashboard. It lists comments newest first, by
page, filtered to open or resolved ones. **View** opens the page with that thread open.

A link to a single thread works anywhere: it is the page's address with `?d2r_comment=` and the thread's
id. Sending one to somebody on the list takes them straight to it.

## Answering from an agent or the command line

The site an AI agent built can be the agent's to fix. With the [MCP server](/docs/mcp#answering-comments),
`list_comments` hands it each open thread — the page, the words the commenter selected, and every comment
— and after it publishes the change, `reply_comment` answers on the page. The
[CLI](/docs/cli#comments) does the same from a terminal or a script:

```bash
drop2run comments my-site
drop2run deploy dist
drop2run comments reply 01JQ… "Fixed — the new price is live" --site my-site
```

Only the account's owner can answer or resolve this way. A reply sent through either appears under your
name exactly as one you typed on the page, and the people in the thread get the same email — the agent is
acting for you, on what you asked it to do. It leaves the thread open unless you ask it to resolve, so the person
who raised it sees the answer on the page and can resolve it themselves.

Comments are written by the people viewing the site, and an agent reading them should treat them as
requests about the site, not as instructions. Both the MCP server and the [agent skill](/docs/for-agents)
tell it so; review what it proposes before letting it act on a stranger's comment.

## Emails

- **You**, and every other owner of the account, get one email per site for every ten minutes in which
  somebody commented, quoting the start of each comment. Your own comments are left out of yours.
- **Everyone else in a thread** gets an email when somebody replies to it, collected the same way. Nobody
  is emailed about their own replies, and somebody taken off the list stops getting them.

You hear about replies in your own threads through the first email only, so one comment never reaches
you twice.

## Limits

- Each person can write 30 comments a minute and 500 a day on one site — 10 a minute and 100 a day on a
  site open to anybody signed in, except you.
- Each site holds a fixed number of comments, set by your plan. At the limit, new comments are refused
  until some are deleted.

## When the comment layer does not appear

- **Who can comment** is set to **Nobody**, or to **People you invite** on a site that is not invite-only.
- **You are not signed in on the site.** On an invite-only site, open it through its invitation or from the
  dashboard, which signs you in on the way. On a site open to anybody signed in, use **Comment with
  Drop2Run** on the count.
- **The owner blocked you.** You can still read; the toolbar says you cannot comment.
- **Your pages set a strict Content Security Policy.** The comment layer is a script served from the
  site's own address, which styles itself inline and talks back to that address over HTTPS and a
  WebSocket. It needs `script-src 'self'`, `style-src 'unsafe-inline'` and `connect-src 'self'`; a policy
  without them blocks it or leaves it unstyled, and there is no way around that from our side — loosen
  the policy while the site is being reviewed.
- **The page is a PDF, Office, ebook or image file on a documents site.** On a site published from documents
  rather than HTML, comments work on Markdown, code and plain-text files (`.txt`, `.log`), and on `.csv`
  files, which are shown as a table: pin or select text the same way. The other kinds are shown as pictures of pages or in a frame of their own, with
  no text of the page to attach a comment to — the toolbar is there to read and reply, without the
  **Comment** button. An HTML file shown inside the reader is the same; open the page on its own with the
  toolbar's **Raw** (its address with `?raw` added) to comment on it like any other page.