If you run a WordPress site for more than a week, you will meet WordPress comment spam. Messages arrive about cheap watches, miracle supplements and strangely enthusiastic compliments on a post that no one has read. Most of it is harmless in a literal sense, and almost all of it is a nuisance. Some of it is worse.
This guide explains why spam comments matter, what WordPress gives you for free, what other tools add, and when the best answer is to turn comments off entirely.
Why WordPress Comment Spam Matters
It is tempting to treat spam as tidying: delete it and move on. But a pile of unmoderated comments causes real trouble.
- Search standing. A page filled with links to pills and gambling sites looks poor to visitors and to search engines. Spam you approve, or let through by accident, becomes part of your page.
- Malicious links. Some spam comments are not selling anything. They link to pages that push malware or phishing. If a real visitor clicks through from your page, your site was the doorway.
- Server load. Bots post fast and in bulk. Each submission costs a database write and often a notification email. A flood can slow down a small host.
- Wasted time. Sorting real comments from fake ones eats attention you would rather spend on your content.
- A sign of neglect. A comment section full of junk tells readers nobody is looking after the site.
There is also a quiet risk. Sites that were hacked to host spam links often show strange comments or pages first. If you see spam where you never expected it, our article on the WordPress pharma hack explains how that kind of infection looks.
Start With the Core Discussion Settings
Most WordPress comment spam is lazy, and WordPress includes a good set of tools to catch it. Most sites never touch them. Open Settings > Discussion in wp-admin. The wording is documented on the official Discussion settings screen page.
| Setting | What it does | Suggested choice |
|---|---|---|
| Comment author must fill out name and email | Makes spammers fill two fields | On. WordPress admits the details are not verified, so it is a speed bump |
| Users must be registered and logged in to comment | Only signed-in users can comment | On if you run a membership site, otherwise usually off |
| Automatically close comments on articles older than X days | Disables the form on older posts | On, for example after a month or two |
| An administrator must always approve the comment | Every comment waits for you | On for small sites |
| Comment author must have a previously approved comment | Known commenters skip the queue | On, as a helpful middle ground |
| Hold a comment in the queue if it contains X or more links | Catches link-heavy spam | Set to 1 or 2 |
| Comment moderation list | Words, names, URLs, IPs or user agents that hold a comment | Fill in with terms you keep seeing |
| Disallowed words list | Matches are treated as spam without a warning | Use sparingly |
A few notes on the less obvious ones:
- Close old posts. Spammers love old posts, because nobody watches them. Closing comments after a set number of days keeps the form off the pages you never revisit. The documentation notes that existing approved comments stay visible.
- Limit links. Spammers once stuffed comments with many links. The docs point out that most now use only one or two, so a low number works better than the default.
- Be careful with the word lists. The documentation warns that the lists match inside words, so a short word such as "press" will also match "WordPress". They also warn that the stricter list can delete real comments without warning. Start with the moderation list, which only holds a comment for your review.
Key takeaway: The core settings catch lazy spam. They will not stop a determined bot, which is why most sites add a filter or CAPTCHA on top.
Use an Anti-Spam Tool
The core settings work on rules you write. Anti-spam plugins and services work on patterns they have learned from many sites, which catches things you would never think to list.
When you choose one, look for:
- How it decides. Does it score each comment, check against a shared database or use a challenge?
- Where your data goes. Many send comment text and visitor details to an outside server. If you have visitors in places with strict privacy laws, read the policy.
- What happens to false positives. Real comments sometimes get flagged. You need a spam folder you can review, not a silent delete.
- Cost for your type of site. Some services are free for personal sites and paid for business ones.
- Whether it is maintained. A spam tool that has not been updated in a long time can be a risk itself.
We will not name a winner here, because the right pick depends on your site. Whatever you choose, keep one rule: never rely on a filter you do not check. Look at the spam folder once a week for the first month, rescue any good comments and then you will know how well it works.
CAPTCHA and Honeypots
Two techniques deal with bots before the comment even reaches WordPress.
CAPTCHA
A CAPTCHA is a small test that people pass easily and bots do not. Modern ones, such as Cloudflare Turnstile and Google reCAPTCHA, often work invisibly in the background and only show a challenge when something looks off.
Pros: very effective against automated spam, and it stops the bot before the comment is saved. Cons: it adds a script to your page, a few visitors with strict privacy tools may see problems and it does not stop humans paid to post by hand.
Honeypots
A honeypot is a hidden form field. Real visitors never see it, so they never fill it in. Bots fill in every field they find. If the hidden field has a value, the comment is rejected.
Pros: invisible to visitors and costs nothing in user experience. Cons: simple bots that look at how the page is displayed can skip the field, so it works best alongside other methods.
Many anti-spam plugins combine both ideas. If you are comfortable with a little code, a honeypot is a good first layer on a custom comment form.
When to Switch Comments Off Entirely
Here is the honest question most site owners skip: does anyone actually leave useful comments on your site?
If your site is a brochure for a business, a portfolio or a set of service pages, the answer is probably no. The only comments are spam. For those sites, the best fix is to remove the form.
You can do it in several ways:
- Per post or page. Untick Allow comments in the editor's discussion settings.
- For new posts. In Settings > Discussion, untick "Allow people to post comments on new articles".
- For existing posts in bulk. Use the bulk edit option on the Posts list and set Comments to Do not allow.
- Site wide, including the admin menu. A plugin or setting that removes comment support from every post type and hides the Comments screens.
If you keep comments on some posts only, such as a blog but not your pages, make sure the page post type is closed, because attackers often find the one form you forgot.
Pingbacks and Trackbacks
Comments are not the only way spam gets in. Pingbacks and trackbacks are automatic notices that tell your site another site has linked to it. Each one appears as a comment.
The documentation lists two related settings on the Discussion screen: one that sends notices to sites you link to, and one that allows link notices from other sites. In practice, the incoming kind is mostly used to place links on your site, and the outgoing kind is abused to make sites send traffic at each other.
Unless you rely on pingbacks to see who is linking to you, turn both off. The same goes for the old XML-RPC interface, which pingbacks use under the hood. Our guide to XML-RPC explains why it is worth closing too.
What Stack Guard Does
Stack Guard focuses on blocking the routes spam uses, and on cleaning up afterwards, not on guessing what a comment means.
- Free: disable comments site wide. In the Hardening tab, the switch closes comments on every post type and removes the Comments screens from the admin. Existing comments stay in the database.
- Free: disable pingbacks and trackbacks. It stops other sites sending notices to yours and yours sending them out. See the Hardening feature page for the full list.
- Pro: CAPTCHA on comments. Stack Guard can add a Cloudflare Turnstile or Google reCAPTCHA check to your comment form, alongside sign-in, registration and password reset. People who can moderate comments are never asked. Comments are off by default in the settings, so you choose when to turn them on. The CAPTCHA documentation shows how to get keys and test them, and the Login Protection page puts it in context with the other sign-in defences.
- Pro: delete all comments in one step. The Delete All Comments button permanently removes every comment, approved, pending or spam. It cannot be undone, so take a backup first.
One thing to be clear about: Stack Guard's CAPTCHA is a check, not a spam-scoring filter, and it does not review the text of comments. If you leave comments on, pair it with the core moderation settings above.
A Cleanup Plan You Can Follow Today
- Back up the site. Do this before bulk-deleting anything. Our guide on how to back up a WordPress site has the steps.
- Decide: comments on or off? If nobody uses them, switch them off and skip to step 7.
- Tighten Settings > Discussion. Require a name and email, close comments on old posts, hold comments with 1 or 2 links and require a previously approved comment.
- Switch off pingbacks and trackbacks in the same screen.
- Add a CAPTCHA or an anti-spam tool. Check it works by posting a test comment while signed out.
- Review the moderation queue. Approve the real ones, and empty the spam.
- Look for signs of a bigger problem. Spam in places that are not comments, such as new pages or hidden links in your posts, is one of the signs your WordPress site has been hacked, and a reason to run a scan. Read how to scan WordPress for malware.
- Check again in a month. If your spam queue is still growing, add a layer.
Fighting WordPress comment spam is mostly about making your site a less rewarding target than the next one. Two or three layers, one hour of setup and a weekly glance at the queue is usually enough.