How to prevent comment spam on WordPress

Comment spam is noisy, bad for readers, and sometimes dangerous. Bots flood comment forms with junk links, fake praise, and phishing or malware URLs. Left alone, that mess hurts trust, wastes moderation time, and can drag SEO down if search engines see a wall of low-quality outbound links.

You do not need a perfect system. You need enough friction that bots fail and humans can still reply when you want them to.

What comment spam looks like

Irrelevant replies under posts, often with an author URL or links in the body. Many are generated by bots aiming for SEO juice or to push scams. Some try to look helpful (“Great post!”) so you approve them by accident.

On WordPress, comments are a public write surface. Treat them like one.

Why it matters

SEO

A comment section packed with spammy links can make a page look neglected or untrustworthy. That is not always a formal “penalty,” but it is content you do not control and would not publish yourself. Clean comments beat a spam dump every time. Background reading: UGC and comments in SEO.

User experience

People skip sites that look abandoned. Spam in the thread signals nobody is minding the store.

Security

Malicious comments can point visitors to phishing pages or drive-by downloads. Even if your site is fine, you become the delivery channel. Pair comment hygiene with broader hardening from the WordPress security checklist.

Practical ways to cut comment spam

Stack a few of these. One toggle rarely stops everything.

1. Require manual approval

In Settings > Discussion, enable Comment must be manually approved. Nothing goes live until you say so. It is slower, but it kills most automated spam cold.

Also useful: Comment author must have a previously approved comment so known good writers get through faster after the first approval.

2. Use Disallowed Comment Keys

Same Discussion screen. Add words, domains, and patterns you never want published. Matching comments go to trash (or are held, depending on how you use the related moderation fields).

Examples worth blacklisting over time: common pharmacy spam terms, known junk TLDs in author URLs, and phrases that only show up in bot paste jobs.

3. Close comments on old posts

Bots love forgotten archive posts. Enable Automatically close comments on articles older than X days and pick a window you can still watch (30, 60, or 90 days is common).

You can reopen comments on a specific post when a conversation is still active.

4. Require registration (when it fits your audience)

Users must be registered and logged in to comment drops bot volume hard. It also drops casual comments. Use it on sites where discussion quality matters more than volume.

If you open registration, lock down who can register and what role they get. See WordPress user roles and least privilege.

5. Add a CAPTCHA or similar challenge

A CAPTCHA or reCAPTCHA on the comment form stops a lot of dumb bots. Use a maintained plugin from wordpress.org, configure keys carefully, and test the form on mobile. Accessibility and privacy trade-offs exist; weigh them against your spam volume.

6. Use a dedicated anti-spam plugin

Built-in moderation plus filters still leave gaps. Two options that have stayed relevant for years:

• Akismet: Checks comments against a large spam database. Widely used; some plans are paid.
• Antispam Bee: Local filtering options, no third-party comment data required in many setups. Popular where GDPR-minded defaults matter.

Install only what you need, keep it updated, and confirm it still matches your privacy expectations. Plugin selection tips: how to tell if a WordPress plugin is secure and WordPress plugins as security risks.

7. Consider third-party comment systems carefully

Services like Disqus shift spam fighting to their stack, but they also add scripts, privacy questions, and another account surface. Prefer native comments plus moderation unless you have a clear reason to outsource the thread.

Keep an eye on what gets through

Review the spam and moderation queues weekly when traffic is up. Patterns in the junk (same domains, same phrases) should go straight into Disallowed Comment Keys.

If spam arrives with weird redirects, unknown admins, or other compromise signs, you may be past “comment spam” and into malware cleanup. For day-to-day hardening beyond comments, use the WordPress security hardening guide.

Quick setup checklist

1. Manual approval on
2. Close comments on old posts
3. Disallowed Comment Keys filled with known junk
4. Anti-spam plugin installed and updating
5. CAPTCHA only if bots still win
6. Registration required only if your audience can live with it

That combination keeps most comment spam out without turning every post into a locked box.