There’s no auto-moderation — I went and checked rather than guessing. The project edit page offers exactly three community settings (Disabled / Comments / Discussion board) and nothing else: no keyword list, no held-for-review queue, no per-project blocklist. So SagaStudio is right that the feature doesn’t exist.
But your actual ask was a solution for when you don’t have time to check, and I think there is one nobody has mentioned, because itch’s own plumbing gives it away.
Look at how itch words a comment notification. Mine reads: “APS Games posted in your topic Bombercup World Cup Football…” — your topic. And clicking a comment’s timestamp lands on itch.io/post/<id>, the same post-ID namespace as these forum posts, with /post/<id>/view-in-topic redirecting to yourgame/comments. Your comment section isn’t a separate comments feature — it’s a community topic you own, rendered differently.
Two things fall out of that.
1. You can be notified on every comment. Account settings -> Email notifications has “People reply to my posts and topics”. Given itch classes your comment section as your topic, that’s the setting that covers it — worth confirming it’s ticked. It won’t stop the spam, but it turns “I find it whenever I next look” into “I get a mail and delete it in a minute”, and when the harm is a player clicking the link, exposure time is the whole game.
2. Your reason for ruling out the Discussion board may not hold. If the comments already are a topic, switching community_type changes how that topic is presented rather than migrating a different data store — so the hundreds of existing comments plausibly survive. I’d call that strong evidence, not a promise, and I wouldn’t test it live on something as popular as COBB CAN MOVE on a stranger’s inference. But it’s a precise enough question that support can answer yes/no, and it’s worth asking before you discard the option.
Two more that work regardless:
Report them as well as deleting. Delete-and-ban is local to you — it cleans your page and the campaign never notices, which is why they keep coming. This exact pattern (impersonate the dev, “new update at <link>”, aimed at popular free games) is hitting a lot of pages right now, and a run of reports with matching wording is what makes it legible as one campaign rather than twelve unrelated nuisances.
Put the contradiction on the page, above the comments. One line in the description: updates only ever appear here as devlogs, and you will never post a download link in the comments. That one works at 3am while you’re asleep, which no amount of moderation-when-you-have-time does — and on a game with that many players, your regulars start replying “that’s not the dev” before you’ve even seen it.
COBB CAN MOVE being popular enough to attract a dedicated impersonation campaign is a grim kind of compliment 🎮
One thing that’d sharpen the report: are those accounts brand-new throwaways, or aged accounts with some history behind them?