Your WordPress comment moderation queue fills with hundreds of entries daily — casino links, pharmaceutical spam, nonsense text with embedded URLs, fake praise laced with backlinks. Or spam comments are appearing published directly on posts without going through moderation. Or genuine comments from real visitors are getting caught by the spam filter alongside the junk. WordPress spam comments are a persistent problem for any site with comments enabled, but they are entirely manageable with the right configuration — most sites can reduce spam comments to near-zero without disabling comments entirely. This fits into the wider topic we cover in our WordPress Errors Complete Guide.
WordPress Spam Comments — Why They Happen and How to Stop Them
Understanding why WordPress spam comments get through helps configure the right defences. Spam comments come from two sources: automated bots that submit comments by directly calling WordPress’s comment-posting API (bypassing the browser form entirely), and human-operated spam farms that manually submit low volumes of targeted spam. Each requires different countermeasures.
Bot-submitted WordPress spam comments are the majority of spam on most sites. These bots crawl the web for WordPress comment forms, detect the standard comment-posting endpoint (/wp-comments-post.php), and submit thousands of comments per hour without loading the actual page or the form. They completely bypass JavaScript-based protections (CAPTCHAs, honey pot fields) because they never render JavaScript — they simply POST to the WordPress comment endpoint directly. This is why many sites report spam getting through despite having reCAPTCHA installed: bots that submit directly to the endpoint bypass the CAPTCHA check entirely.
Human-operated WordPress spam comments are lower volume but harder to block automatically — they read as plausible generic praise (“Great article, very helpful!”) with a spammy website URL in the URL field. These pass CAPTCHA and keyword filters because the comment text is not obviously spammy and a human completed the CAPTCHA. The defences against this type of spam are link analysis (many spam comments have suspicious URLs), comment moderation requiring approval, and Akismet’s machine learning which has been trained on billions of spam comments and can identify the pattern even when the text looks legitimate.
Akismet — The Essential First Defence
Akismet is the most effective single defence against WordPress spam comments and essential for every site. It checks every submitted comment against a global database of known spam patterns, trained on billions of comments across millions of WordPress sites. Installing and configuring Akismet correctly stops 99%+ of spam on most sites.
Akismet ships pre-installed with WordPress but requires an API key to activate: navigate to Plugins → Akismet Anti-Spam → Set Up Your Akismet Account → create an account at akismet.com (free for personal sites, paid for commercial sites) → copy the API key → paste it into the Akismet settings. Once active, Akismet automatically checks all incoming comments. Comments it identifies as spam are moved to the Spam folder rather than appearing in moderation or being published — you can review the Spam folder at any time and mark any incorrectly classified comments as “Not Spam” to improve Akismet’s accuracy for future submissions.
Keep the spam folder clean to prevent WordPress spam comments from bloating the database: Comments → Spam → once you have confirmed no legitimate comments are caught, click “Empty Spam.” Delete spam regularly because a large spam database consumes significant database space and slows the Comments → Spam page. Akismet automatically discards spam older than 15 days, but on high-traffic sites accumulating hundreds of daily WordPress spam comments, manual emptying keeps the database lean. Configure the discard setting in Akismet → Settings → “Silently discard the worst and most pervasive spam” — this discards obvious spam entirely without storing it, preventing database bloat from spam accumulation. According to Akismet’s official documentation, the service has blocked over 600 billion spam comments since launch and catches an average of 7.5 million spam comments per hour across the WordPress ecosystem.
Honeypot, CAPTCHA, and Comment Settings
Akismet handles most WordPress spam comments, but combining it with additional layers eliminates the spam that passes Akismet’s filter. The three most effective additional layers are honeypot fields, comment approval requirements, and URL limits.
Honeypot fields stop bot-generated WordPress spam comments — invisible fields humans never fill in (because they are hidden with CSS) but that bots fill in automatically when they submit comment forms without rendering CSS. A comment submitted with a value in the honeypot field is identified as bot-generated and rejected silently. Install the Antispam Bee plugin (free, no account required) → activate → it automatically adds a honeypot field to the comment form and blocks submissions that trigger it. Antispam Bee also blocks comments from suspicious IP addresses, blocks comments that contain links only (a common spam pattern), and rejects comments submitted within seconds of page load (bots do not read the content before commenting).
WordPress’s built-in comment settings reduce WordPress spam comments directly without any plugin: Settings → Discussion → “Comment author must fill out name and email” (prevents completely anonymous submissions), “Users must be registered and logged in to comment” (eliminates anonymous spam entirely, at the cost of reducing genuine comments from non-registered visitors), and “Hold a comment in the queue if it contains [X] or more links” (most spam comments contain multiple links — setting this to 1 or 2 catches the majority of link-spam). Under “Comment Blacklist,” add known spam keywords, URLs, and IP ranges — any comment containing these strings is immediately moved to spam. Under “Comment Moderation,” add terms to hold suspicious comments for review. These built-in settings work independently of Akismet and provide a zero-dependency defence layer.
Blocking Comment Spam at the Server Level
For sites receiving extreme volumes of WordPress spam comments — thousands per day — thousands per day — server-level blocking is more efficient than WordPress-level filtering because it rejects spam before PHP processes it, reducing server load significantly. Two approaches work well without technical complexity.
Block direct POST requests to wp-comments-post.php without a valid referrer: add this to .htaccess above the WordPress block:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-comments-post.php*
RewriteCond %{HTTP_REFERER} !.*yoursite.com.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule .* - [F,L]
</IfModule>This server-level rule blocks the majority of WordPress spam comments from bots that POST directly that POST directly without loading the page. Replace yoursite.com with the actual domain. Legitimate comments always include the site domain as the referrer because the visitor loaded the comment form from the site before submitting. The HTTP_USER_AGENT ^$ condition also blocks submissions with no user agent string, which are almost exclusively bots. After adding this rule — the most robust server-level fix for WordPress spam comments — test comment submission from the front-end by posting a test comment — if it posts correctly, the rule is working and is not blocking legitimate traffic. Our guide on fixing WordPress file permissions covers .htaccess editing safety, including making a backup before adding any custom directives.
Cleaning Up Existing Spam and Disabling Comments Selectively
After configuring spam prevention, cleaning up existing WordPress spam comments in bulk and managing comments on older posts prevents the queue from remaining full of pre-prevention spam.
Bulk delete spam comments: Comments → filter to Spam → select all → Bulk Actions → Delete Permanently. For very large spam queues (tens of thousands), use WP-CLI from the server command line: wp comment delete $(wp comment list --status=spam --format=ids) --force — this deletes all spam comments in seconds without the timeout risk of processing thousands through the admin interface. After clearing spam, verify the comment count in the admin is accurate and that the Comments → Spam queue resets to zero.
Disable comments on old posts to prevent WordPress spam comments accumulating on content that is no longer being actively discussed. Settings → Discussion → “Automatically close comments on posts older than [X] days” — set to 180 or 365 days. Comments on posts older than the specified threshold are automatically closed, preventing new spam from targeting old content. For existing old posts, bulk-close: Posts → All Posts → filter by date → select all → Bulk Actions → Edit → set “Comments” to “Do not allow” → Update. This closes comments on all existing old posts without changing new post defaults. Combining automatic comment closing for age with Akismet and honeypot for active posts reduces WordPress spam comments to near-zero on sites with mixed old and new content. Reviews from the WordPress security community confirm that Akismet combined with the referrer check .htaccess rule eliminates over 99% of automated WordPress spam comments on sites that implement both simultaneously. Our guide on fixing WordPress not sending emails covers the email notification system that alerts site owners to new comments awaiting moderation — relevant for ensuring spam filter notifications and genuine comment notifications reach the correct inbox.
Cloudflare’s free plan provides a powerful additional layer against WordPress spam comments through its bot management and firewall features. Navigate to the Cloudflare dashboard → Security → Bots → enable “Bot Fight Mode” — this blocks known bot IP ranges from reaching your site, preventing many automated comment spammers before they even reach WordPress. For more targeted blocking, create a Cloudflare WAF rule: Security → WAF → Custom Rules → create a rule that blocks requests matching URI Path contains "wp-comments-post.php" AND User Agent does not match [known browser patterns]. Cloudflare applies this rule at the edge network level, blocking bot spam comment submissions before they consume server resources or PHP processing time. This Cloudflare-level blocking complements the .htaccess referrer rule — each catches different bot patterns, together eliminating the vast majority of automated WordPress spam comments before they reach WordPress’s comment processing system.
reCAPTCHA v3 (Google’s invisible CAPTCHA) provides the most user-friendly challenge for preventing WordPress spam comments from human-operated spam farms that bypass honeypot fields. Unlike reCAPTCHA v2 (which shows a checkbox or image challenge), v3 works invisibly — it analyses user behaviour and assigns a score without asking the visitor to do anything. Install WPForms or a dedicated Comment reCAPTCHA plugin → configure with a Google reCAPTCHA v3 API key (available free from Google reCAPTCHA admin) → set a threshold score (0.5 is standard — scores below this are likely bots or spam farms). All major comment form plugins support reCAPTCHA v3 integration, and Cloudflare Turnstile is an increasingly popular GDPR-friendlier alternative that does not send user data to Google while providing equivalent spam prevention capability.
Monitoring the ratio of spam to legitimate comments over time reveals whether the configured defences are working and whether adjustments are needed. Comments → screen options → show the Spam column on the Posts page to see per-post spam counts. A post with 500 spam comments and 5 legitimate comments indicates it has been targeted by a specific spam campaign — that post may need comment closure or a temporary manual moderation requirement added via the Settings → Discussion → “Hold a comment in the queue” keyword additions. For posts that consistently generate WordPress spam comments disproportionate to their traffic, closing comments on those specific posts while keeping them open on actively engaged content is the most targeted approach, preserving the community conversation value of comments without the administrative overhead of managing disproportionate spam on a subset of posts.
Comment threading depth and display settings interact with WordPress spam comments management in a way that is not immediately obvious. WordPress allows nested comment replies up to 10 levels deep by default. Spam bots that target specific comment threads can fill all levels of a popular thread with spam before moderation can catch up. Limiting threading depth to 3 or 4 levels (Settings → Discussion → “Enable threaded comments” → set to 4 levels) reduces the attack surface for thread-specific spam campaigns without meaningfully affecting the quality of genuine conversation on most content. Combined with the requirement for prior comment approval — Settings → Discussion → “Comment author must have a previously approved comment” — repeat legitimate commenters bypass manual moderation while all new commenters (including bots that get past Akismet) require one-time approval before subsequent comments are auto-approved.
Guest post spam — where spammers submit contact form entries or author applications rather than WordPress spam comments — often increases when comment spam is successfully blocked, because spammers pivot to whichever open submission form remains available on the site. After implementing comment spam controls, review all other public submission forms (contact forms, author application forms, registration forms) and apply the same Akismet, honeypot, and CAPTCHA protections. Most form plugins (Contact Form 7, WPForms, Fluent Forms) integrate with Akismet and reCAPTCHA through their settings — enabling these integrations on all public forms creates a consistent anti-spam posture across every submission entry point on the WordPress site. See also WordPress Trackback for a related case.
