How to Stop Spam Comments in WordPress (Without Killing Real Ones)

If you have comments open on a WordPress site, you’re getting spam. Not maybe. Definitely. The good news: you can stop spam comments in WordPress almost completely with a few settings changes and one sensible tool, and none of it requires a CAPTCHA that makes real readers solve puzzles.

This guide walks through the exact order to tackle it: the free Discussion settings first, then a couple of code tweaks, then the anti-spam options worth installing. Plus the nuclear option, for sites that never needed comments in the first place.

Why Is My WordPress Site Getting So Many Spam Comments?

WordPress sites get spam comments because bots automatically crawl the web looking for comment forms, then post links to scam, gambling, or SEO-manipulation sites. The bots aren’t targeting you personally. Any WordPress site with comments open is on their list, and the default comment form is easy to find and easy to submit.

The scale is huge. According to Akismet’s own stats, reported by TechCrunch when the service passed 50 billion filtered spam messages, about 92% of all comments Akismet checked were spam. That figure is a few years old, but nothing about comment spam has gotten easier since.

One detail matters for everything below: most comment spam bots never load your comment form at all. They send a POST request straight to wp-comments-post.php. That’s why tricks that only change the visible form (like hiding a field with CSS) work less well than people expect.

Does Comment Spam Actually Hurt Your Site?

Yes. Comment spam hurts your site in three ways: published spam links damage trust and can trigger Google’s user-generated spam policies, thousands of stored spam comments bloat your database, and a flood of moderation emails buries the real ones. Even unpublished spam has a cost.

WordPress already adds rel="nofollow ugc" to links in comments, so spammers don’t get much SEO juice. They don’t care. They’re playing a numbers game. But a page with dozens of approved pharmacy links looks abandoned to visitors, and Google’s spam policies specifically call out user-generated spam on sites that don’t moderate it.

The database side is easy to ignore until it isn’t. Every spam comment sits in wp_comments plus wp_commentmeta until it’s deleted. If your spam folder has tens of thousands of entries, that’s a cleanup job (covered in this WordPress database cleanup guide).

Step 1: Lock Down the WordPress Discussion Settings

The fastest free way to stop spam comments in WordPress is under Settings > Discussion. Turning on manual approval, holding comments with links, and closing comments on old posts stops most spam from ever going live, without installing anything.

Here’s what to change in the WordPress Discussion settings:

1. Turn off pingbacks and trackbacks. Uncheck “Allow link notifications from other blogs.” Trackbacks are almost entirely spam now, and nobody misses them.
2. Require manual approval, or at least a previously approved comment. “Comment author must have a previously approved comment” is the sweet spot: first-time commenters get moderated, regulars get through.
3. Hold comments with links. Set “Hold a comment in the queue if it contains 1 or more links.” Real readers rarely need to post a link. Spammers always do.
4. Close comments on old posts. Check “Automatically close comments on posts older than X days.” 30 to 90 days works for most blogs. Bots love old posts because nobody’s watching them.
5. Fill the Disallowed Comment Keys box. Words, URLs, emails, or IPs listed here send matching comments straight to trash. Start with the obvious spam terms you see in your queue.

One warning about Disallowed Comment Keys: WordPress matches inside words. Blocking “cialis” also blocks “specialist.” Keep entries specific.

Step 2: Remove the Website Field From the Comment Form

Removing the “Website” field from the WordPress comment form takes away the main reason spammers comment in the first place: a free backlink next to their name. It won’t stop bots that post directly, but it cuts down on the human, copy-paste spam that slips past filters.

Add this to a child theme’s functions.php or a code snippets plugin:

// Remove the Website (URL) field from the comment form
add_filter( 'comment_form_default_fields', function( $fields ) {
    unset( $fields['url'] );
    return $fields;
} );

Real readers don’t miss the Website field. Spammers do.

Step 3: Add a Real Anti-Spam Filter

Built-in settings reduce comment spam, but they don’t filter it. To actually stop spam comments in WordPress at scale, you need a filter that checks every comment before it lands: Akismet, Antispam Bee, or Cloudflare Turnstile are the three worth considering. Pick one, not all three.

Option	How It Works	Cost	Privacy / GDPR	Best For
Akismet	Sends each comment to Automattic’s servers for a spam check	Free for personal sites, paid for commercial sites	Comment data leaves your server; disclose it in your privacy policy	Blogs with lots of comments
Antispam Bee	Local checks (honeypot, timing, patterns) on your own server	Free	No external service required	EU sites and business blogs
Cloudflare Turnstile	Invisible challenge on the comment form, no puzzle for most visitors	Free	Uses Cloudflare; disclose it	Sites already using Cloudflare
Discussion settings only	Moderation rules and keyword lists	Free	Nothing leaves your site	Low-traffic sites with few comments

For most small business sites, Antispam Bee is the strongest default. It’s free, it runs locally, and it doesn’t create a GDPR question you have to answer. Akismet is excellent at catching spam, but commercial sites need a paid plan, and comment data is processed on Automattic’s servers.

Cloudflare Turnstile is the best CAPTCHA alternative if you want a challenge step, because most visitors never see a puzzle. If you already run your site through Cloudflare, it fits right in (here’s how to set up Cloudflare for WordPress without breaking things).

Skip old-school image CAPTCHAs. They annoy humans, hurt accessibility, and modern bots solve many of them anyway.

Should You Just Disable Comments in WordPress?

If your site doesn’t need comments, disabling them is the cleanest way to stop WordPress comment spam for good. Most business websites, portfolios, and service sites get zero real comments, so leaving the form open only invites bots.

Unchecking “Allow people to submit comments on new posts” only affects future posts. Existing posts keep their comments open. To shut comments off everywhere, including old posts and the endpoint bots use, add this snippet:

// Disable comments and pingbacks site-wide
add_filter( 'comments_open', '__return_false', 20, 2 );
add_filter( 'pings_open', '__return_false', 20, 2 );

// Hide existing comments on the front end
add_filter( 'comments_array', '__return_empty_array', 10, 2 );

// Remove the Comments menu from the admin
add_action( 'admin_menu', function() {
    remove_menu_page( 'edit-comments.php' );
} );

With comments_open returning false, WordPress rejects new submissions to wp-comments-post.php too, so bots posting directly get turned away. If you’d rather not touch code, the free Disable Comments plugin does the same job.

How to Delete Thousands of Spam Comments at Once

To delete spam comments in bulk, go to Comments > Spam and click “Empty Spam,” or use WP-CLI for very large queues. The dashboard method works for a few thousand; WP-CLI is faster and won’t time out on huge numbers.

If thousands of spam comments are sitting in Pending instead of Spam, that’s the harder case. Select them in batches and mark as spam, or delete them with WP-CLI:

# Permanently delete all comments marked as spam
wp comment delete $(wp comment list --status=spam --format=ids) --force

# Permanently delete all pending (unapproved) comments
# Check first that no real comments are waiting!
wp comment delete $(wp comment list --status=hold --format=ids) --force

Take a backup before running bulk deletes. --force skips the trash, so there’s no undo.

When Spam Comments Are a Sign of Something Bigger

Regular comment spam is normal and isn’t a security breach. But spam that appears as already-approved comments, spam links inside your posts, or new admin users you didn’t create are warning signs that the site itself may be compromised, not just the comment form.

If that sounds familiar, go through these signs your WordPress site is hacked before doing anything else. Bots that hammer comment forms often hammer login pages too, so it’s also worth tightening WordPress login security while you’re at it.

The Bottom Line

Stopping spam comments in WordPress isn’t about one magic plugin. It’s layers: tighten the Discussion settings, remove the Website field, add one real filter like Antispam Bee or Turnstile, and close comments entirely if your site doesn’t need them. Do those four things this week and the spam folder goes quiet.

Want a WordPress site that’s built clean and maintained properly from the start? Take a look at recent projects.

Frequently Asked Questions