How to Stop WordPress Comment Spam: A Layered Guide

Comment spam on WordPress can flood your inbox, slow down your site, and hurt your credibility. This guide walks you through a practical, layered defense—starting with built-in settings and moving to plugins and server-level tricks—so you can block most spam automatically while keeping legitimate comments easy to post.

What You’ll Need

Administrator access to your WordPress dashboard
FTP or cPanel access (for optional server-level steps)
Ability to install plugins (most WordPress sites allow this)

Step-by-Step

Turn on comment moderation and hold spam in the queue.
Go to Settings → Discussion. Check the box for “Comment must be manually approved� and “Comment author must have a previously approved comment.� This means the first comment from a new user waits for your approval, while returning commenters pass through automatically. Also set “Before a comment appears� to require manual approval for all comments—this is stricter but effective if you get few legitimate comments.
Enable the built-in “Comment Blacklist� and “Disallowed Comment Keys.�
In the same Discussion screen, scroll to “Comment Blacklist.� Add common spam words, URLs, and email domains (e.g., viagra, casino, http:// in the comment body). Be careful: adding http:// will block any comment containing a link, which may be too aggressive if you want to allow links. Use the “Disallowed Comment Keys� field instead—it sends matching comments straight to spam without holding them for moderation.
Close comments on old posts.
In Settings → Discussion, check “Automatically close comments on articles older than X days.� Set it to 30 or 60 days. Spam bots often target older posts with established comment threads. This reduces your attack surface without affecting new content.
Install a dedicated anti-spam plugin.
Choose one of the following (install from Plugins → Add New):
- Akismet Anti-Spam – The most widely used. It requires an API key (free for personal blogs, paid for commercial sites). It checks comments against a global spam database and automatically filters most spam.
- Anti-Spam by CleanTalk – A paid service that uses a cloud database and also blocks registration spam. It has a free trial.
- WP Spamshield – A free plugin that uses multiple checks (honeypots, time checks, IP reputation) without requiring an external service.
After installing, activate and follow the setup wizard. For Akismet, you’ll need to enter your API key from akismet.com.
Add a honeypot field.
Honeypots are invisible form fields that humans don’t fill in, but bots do. Install a plugin like Honeypot for Contact Form 7 or WP Armour – Honeypot Anti Spam. These add a hidden field to your comment form. If a bot fills it, the comment is silently discarded. This stops many automated spam bots without any user friction.
Use a CAPTCHA for extra protection (optional).
If you still get spam, add a CAPTCHA. Google reCAPTCHA v3 is invisible and scores users based on behavior. Install a plugin like Advanced noCaptcha & Invisible Captcha and configure it to show only when the score is low. This blocks bots while keeping the form easy for humans. Avoid older CAPTCHAs that require typing distorted text—they hurt user experience.
Block IP addresses and user agents at the server level.
If spam persists, you can block known spam IPs via your firewall or .htaccess. First, identify the IPs from your spam comments (the comment meta shows IP). Then, in cPanel, use the “IP Blocker� or add to .htaccess:
```
order allow,deny
deny from 123.45.67.89
allow from all
```
Replace the IP with the actual one. Be careful—blocking a shared IP might block legitimate users. Also, you can block empty user agents by adding to .htaccess:
```
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^$ [OR]
RewriteCond %{HTTP_USER_AGENT} (bot|crawl|spider) [NC]
RewriteRule ^ - [F]
```
This returns a 403 for requests with no user agent or known bot names. Test after adding—some legitimate services (like some feed readers) may have empty user agents.
Disable comments entirely on pages (not posts) if not needed.
For static pages like “About� or “Contact,� you likely don’t need comments. Edit each page, and in the “Discussion� box (under Page Attributes), uncheck “Allow comments.� This removes the comment form from those pages, reducing spam targets.
Regularly clean spam and update your blacklist.
Go to Comments and delete spam in bulk. Use the “Empty Spam� button to clear all spam at once. Also, review your blacklist every month to add new spam patterns you see in the spam folder.

Common Mistakes

Over-blocking with blacklists. Adding too many generic words like “free� or “check� can block legitimate comments. Be specific to your niche.
Relying on a single plugin. No plugin is 100% effective. Layering (moderation + honeypot + plugin) is more robust.
Ignoring the spam folder. Some legitimate comments get marked as spam. Check your spam folder weekly and mark false positives as “Not Spam� to train the filter.
Blocking all IPs from a country. This can block real visitors and is often ineffective because spammers use VPNs.
Not updating plugins. Outdated anti-spam plugins miss new spam techniques. Keep them updated.

Tips

Use a plugin that combines honeypot and time-check. Many spam bots submit instantly; a time-check (e.g., minimum 3 seconds to fill the form) can block them.
Enable “Comment Moderation� queue for new commenters. This gives you a safety net even if other filters fail.
Consider using a third-party comment system like Disqus. It offloads spam filtering to their servers. However, it may slow down your site and gives you less control.
Monitor your site’s load. If spam is heavy, it can consume resources. Plugins like Akismet reduce server load by filtering before saving to the database.

Troubleshooting

Spam still gets through after following all steps? First, check that your anti-spam plugin is active and properly configured. For Akismet, verify your API key is valid. Sometimes plugins conflict—deactivate other comment-related plugins and test. Also, check if your theme’s comment form is missing the honeypot field (some themes override the form). If so, switch to a default theme temporarily to test.

Legitimate comments are being blocked or marked as spam? Review your blacklist—remove overly broad terms. In Akismet, you can adjust the “strictness� setting. For honeypot plugins, ensure the hidden field is not visible to screen readers (if it is, real users might fill it). Also, check if your server’s IP blocking is too aggressive—remove any IP that might be shared.

Comments are slow to appear? If you have manual approval enabled, that’s expected. To speed up, consider allowing comments from users with previously approved comments to bypass moderation.

Plugin conflicts causing errors? If you see PHP errors after installing an anti-spam plugin, deactivate it and check for compatibility with your WordPress version. Use the health check plugin to test.

Spam is coming from a specific IP range? Use a firewall plugin like Wordfence to block that range at the server level, but only if you’re sure it’s not a shared IP for legitimate users.

Frequently Asked Questions

Q: Is Akismet free?
A: Yes, for personal blogs and non-commercial sites. Commercial sites need a paid plan, starting around $10/month.

Q: Will a CAPTCHA slow down my site?
A: reCAPTCHA v3 is invisible and has minimal impact. Older CAPTCHAs can add a few hundred milliseconds, but the trade-off is fewer spam comments.

Q: Can I stop spam without a plugin?
A: Yes, using built-in moderation, blacklists, and closing comments on old posts. This works for low-traffic sites but may not be enough for high-traffic ones.

Q: What is a honeypot and does it affect users?
A: A honeypot is an invisible field. Real users never see it, so it has zero impact on user experience.

Q: Why do I get spam even with Akismet?
A: Akismet catches most, but not all. Some spam is new and not yet in the database. Combining Akismet with a honeypot and moderation covers more bases.

Q: Can I delete all spam comments at once?
A: Yes, in the Comments screen, click “Empty Spam� to permanently delete all spam comments. This is safe.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →