The Complete Guide to Stopping WordPress Comment Spam

Open comments are great for engagement and terrible for your sanity. Within days of enabling them, most WordPress sites start collecting link-stuffed nonsense, "great post, visit my site" filler, and SEO spam aimed at your dofollow links. Here's how to keep the conversation while cutting the junk to near zero.

Start with WordPress's built-in settings

Before any plugin, tune what ships with core. Under Settings → Discussion:

• Hold comments with links for moderation. Almost all spam contains at least one URL; the default threshold of two is worth lowering to one.
• Require name and email. A tiny bar, but it trips the laziest bots.
• Disallow / moderation word lists. Add common spam keywords and known bad domains.
• Close comments on old posts. Ancient posts attract the most drive-by spam; auto-closing after 30–60 days removes a huge target.

Add invisible bot checks

Native settings only go so far. The next layer targets automation directly:

• Honeypot fields that bots fill and humans never see.
• Submission timing checks that reject comments posted milliseconds after page load.
• Rate limiting so a single IP can't post twenty comments a minute.

These are the same techniques that work on contact forms — we go deeper in honeypot vs CAPTCHA.

Screen the commenter's IP and email

Comment spam clusters on known-bad networks and fake email addresses. Two checks pay off enormously:

• IP reputation. Cross-reference the commenter's IP against abuse feeds and DNS blocklists; datacenter and proxy ranges submitting "comments" are almost never real readers.
• Email validation. Reject disposable addresses and non-existent mailboxes — spammers rarely use an inbox they'd have to check.

Analyse the comment content

What survives every earlier layer gives itself away in the text: multiple outbound links, pharma and casino keywords, and homoglyph obfuscation designed to slip past word filters. A content-scoring layer weighs these signals and pushes borderline comments into moderation or the bin.

Any single filter can be beaten. Six cheap, independent filters stacked together almost never are — that's the whole game with comment spam.

Where Akismet fits

Akismet is a solid cloud filter and catches a lot, but it sends every comment (and commenter data) to a third-party service, which some sites can't do for privacy reasons — and it does little about bots that never reach the comment table. A self-contained, layered engine keeps the data on your own server and stops abuse earlier in the request.

A self-hosted, layered approach

Spamify protects WordPress comments out of the box: honeypot, timing and rate limiting are free, and IP reputation, disposable detection and content analysis come with Pro. Everything runs on your server — nothing about your commenters is sent to the cloud — and you keep full control over thresholds, allowlists and whether borderline comments are blocked or just flagged.