Stopping WordPress Comment Spam

Why spam finds WordPress

Why spam finds WordPress so reliably: scale and default openness. WordPress powers a huge share of the web, and its comment system is enabled by default on posts — a standardised, findable target. Bots locate it by crawling for wp-comments-post.php and the comment form's field names, then submit at machine speed: templated praise, spun text, links in author names and bodies.

The economics: a vanishing success rate still pays when submission is free and automated. What spam wants is published links. What it costs you is moderation time, database bloat — tens of thousands of stored comments slow queries and backups — and, if moderation lapses, a site that looks abandoned. The fix is the layer stack below, not any single setting.

Layer 1: Akismet and comment settings

Layer one is Akismet plus strict comment settings — the foundation. Akismet screens every incoming comment against its cloud intelligence, auto-trashing obvious spam and holding questionable ones; personal blogs select the free name-your-price tier, commercial sites need a paid plan (verify current terms at akismet.com).

Under Settings > Discussion: require manual approval for every comment — or at minimum first-time commenters; hold comments with links for moderation. And turn off trackbacks and pingbacks, legacy notification channels most sites no longer benefit from. These settings convert spam from publishable to moderated, which changes its economics completely.

Layer 2: anti-spam plugins and honeypots

Akismet is not the only route. Antispam Bee runs entirely without a cloud account — it trusts commenters with a verified Gravatar, flags comments containing BB code, and can restrict comments by language or country, then deletes stored spam automatically after a set number of days. CleanTalk takes the invisible path: no CAPTCHA, one subscription covering comments, registration forms and contact forms alike. Honeypot plugins (the approach behind Anti-spam and several others) add a form field humans never see — bots dutifully fill it and are rejected silently.

Layer sensibly: Akismet plus one technical filter (a honeypot or Antispam Bee's rules) covers both known spam sources and novel bots. Stacking four or five filters raises the false-positive rate — real readers land in the spam folder — so add layers only when spam actually gets through the first two.

Layer 3: manual approval and blacklists

Moderation is the backstop. Under Settings → Discussion, enable Comment must be manually approved together with Comment author must have a previously approved comment — first-time commenters wait for a human, regulars publish instantly, and you review each new person exactly once. Set the link threshold in Comment Moderation to one link; nearly every genuine comment contains none, while nearly every spam comment contains at least one.

The keyword field underneath does the same for terms: paste spam phrases, suspicious domains and known bad IPs into Disallowed Comment Keys, one per line, and matching comments are held or binned automatically. Instead of assembling your own list, start from the community-maintained WordPress Comment Blacklist on GitHub and prune what over-triggers.

Bulk-deleting spam

An inherited pile needs bulk removal, not one-by-one trashing. In Comments → Spam, the Empty Spam button deletes everything flagged in one click. For unflagged pending comments, filter the list by author, IP address or date range and clear each batch with bulk actions. On hosts with SSH, wp comment delete $(wp comment list --status=hold --format=ids) removes every awaiting-moderation comment in one pass — take a database backup first.

Finish by emptying the trash so the rows actually leave the database, then confirm the layers above are switched on — otherwise the pile rebuilds within days.

Disabling comments by page type or site-wide

Disabling comments is the legitimate nuclear option — and honest assessment comes first: do comments serve this site? Business brochure sites, service pages and product catalogs gain nothing from comments and pay spam's tax regardless.

Per-page: every post editor carries a Discussion panel (enable via Options if hidden) with 'Allow comments' unchecked — pages default to off, posts to on. Site-wide: Settings > Discussion unchecks 'Allow people to submit comments on new posts' for future posts; existing posts need a bulk quick-edit sweep. Middle paths: auto-close comments after 30 days, or require registration. 'Should we have comments?' is a content strategy question — spam management starts with it.

Do spam comments hurt SEO?

Published spam hurts: pages bristling with pharmaceutical links read as neglect to crawlers, user-trust metrics compound it, and Google's guidance for decades has been to moderate or disable unmanaged comments. Stored-but-unpublished spam does not directly harm rankings — search engines never see it — but the bloat tax is real: database size, backup weight, query overhead.

The link-economy footnote: comment links are nofollowed by default, so the SEO spammers chase is largely worthless — the harm is to you, not the gain to them. Bottom line: moderate what publishes, keep the library lean, disable where comments serve nothing — and put the recovered attention into content, the thing that actually ranks. If spam has become a security problem, WebJi®'s WordPress security service handles cleanup, and the full security checklist continues from there.