WordPress Comment Spam: A Layered Setup That Keeps Real Readers

You can stop most WordPress comment spam without a captcha by stacking three layers: tighter Discussion settings in the core, a honeypot-based filter such as Antispam Bee or a cloud filter such as Akismet, and a short moderation routine. Each layer is free on a personal blog, and none of them asks your readers to click on traffic lights. Below is the exact setup, in the order to do it, plus how to avoid deleting the comments you actually want.

Published: 2026-10-16 · 7 min read · Satelo

Why comment spam is more than an eyesore

Most spam comments are written by bots that hope to leave a link on your page. On their own they look sloppy, but the real cost is elsewhere. Google lists "comment spam on blogs" as an example of user-generated spam in its spam policies, and notes that site owners are often unaware it is there. Spam that sits published on your posts is content on your site, even if a bot wrote it.

There is also a reader cost. A thread full of casino links and fake praise tells visitors nobody is looking after the place, and real people stop commenting. Spam control is really community care: the goal is not zero comments, it is zero junk with the least friction for humans.

Layer 1: Discussion settings you should change today

Open Settings → Discussion in your dashboard. Every option below is described on the official Settings Discussion screen documentation. These are the ones that matter for spam:

One detail that trips people up: both word lists match inside words. The documentation's own example is that "press" will match "WordPress". Add whole, distinctive strings, not short fragments.

The setting "Users must be registered and logged in to comment" also kills spam, but it kills most real comments too. Keep it for membership sites, not for a public blog.

Layer 2: a honeypot or a cloud filter (pick one)

Settings slow bots down; a filter catches what gets through. The two most common free choices work very differently.

Do not run both at once unless you have a reason; two filters make it harder to understand why a comment was blocked. A honeypot works because bots fill every field they find, including one that humans never see. That is why it needs no captcha.

A note from the Antispam Bee FAQ: its honeypot field is hidden with inline styles, so a strict Content Security Policy can make it visible. If readers suddenly see an odd extra field in your form, that is the reason.

Layer 3: make spam links worthless

Since WordPress 5.3, links in comments get rel="nofollow ugc" by default, as announced on the Make WordPress Core blog. Google recommends marking UGC links such as comments and forum posts with ugc. So you do not need a plugin for this, but check two things:

• Your theme or comment plugin has not stripped the attribute. Open a post with a comment link, view the page source and search for ugc.
• You are not removing it for everyone. Google allows dropping the attribute for contributors with a long record of quality, but that is a manual decision for regulars, not a site-wide switch.

The attribute does not stop bots from posting, but it removes part of their motive and protects your site from vouching for whatever they link to. If the different values confuse you, our guide to nofollow vs sponsored vs ugc covers them side by side.

Many blogs also remove the "Website" field from the comment form. Fewer link slots means fewer link-hunting comments. It is a small code snippet or a setting in some themes; the trade-off is that regular readers lose a way to show their own blog.

Pingbacks and trackbacks: switch them off

Trackbacks were built for a time when blogs talked to each other through notifications. Today they mostly arrive as automated spam. Turn off Allow link notifications from other blogs in Discussion settings. This changes the default for new posts only, so for old posts select them in Posts → All Posts, choose Edit in bulk actions and set Pings to "Do not allow".

The setting above it, Attempt to notify any blogs linked to from the article, is about your outgoing pings. It does not cause spam, but the docs note that many links in a post can slow publishing while WordPress contacts each site. Many small blogs turn it off too.

What about captchas?

Google's own guide to preventing abuse lists captchas as one option, mostly for automated sign-ups, next to moderation, blocklists, and marking links. They work, but they have costs on a comment form:

• They add friction for the people you want to hear from, especially on mobile.
• Most load a third-party script, which adds weight and may need a cookie notice. If you are already fighting slow pages, see our notes on Core Web Vitals for small sites.
• Some bots and paid solving services get through anyway.

Our suggestion: start with layers 1 to 3. Add a captcha only if, after a couple of weeks, the queue is still unmanageable, and prefer a privacy-friendly option that does not show a puzzle to most visitors.

A 10-minute moderation routine

With "previously approved comment" and the one-link rule on, your queue holds first-time commenters and anything with links. A simple routine keeps it under control:

1. Check the queue on a fixed schedule, for example once a day. Turn on "A comment is held for moderation" email only if comments are rare.
2. Approve real first-timers quickly. Once approved, their next comments appear instantly, so the friction is one-off.
3. Mark spam as spam, do not just delete it. It stays in the Spam folder, so you can still rescue a false positive, and your filter plugin sees the decision.
4. Skim the Spam folder weekly for false positives. Short comments, comments in another language and comments with one useful link get caught most often.
5. Add repeat patterns (a domain, a phrase) to the moderation list, not to the disallowed list, until you are sure.

Example of a pattern worth adding, for illustration: if ten comments in a week contain the same shortened-URL domain, add that domain to the moderation list.

How not to lose real commenters

Overly strict rules quietly turn away the readers you want. Signs you have gone too far: no comments at all for weeks on posts that get visits, or regular readers emailing you that their comment "disappeared". To stay friendly:

• Keep the form short: name, email, comment.
• Tell people under the form that first comments are moderated, so a delay does not look like a bug.
• Reply to real comments. A visible conversation invites more of them, and a blog that answers looks cared for.
• Do not fight spam by closing comments on all posts. Closing old posts is enough.

Commenting is also how many blog friendships start. If you want more of that kind of contact with other site owners, our blogger collaboration guide covers ways to work together without trading spammy links.

Your anti-spam checklist

• Pingbacks and trackbacks off, also on old posts.
• Name and email required.
• Previously approved author rule on.
• Hold comments with 1 or more links.
• Close comments on old posts.
• One filter installed: Antispam Bee or Akismet.
• Comment links still carry ugc in the page source.
• Privacy policy updated if comments go to an external service.
• Queue checked daily, Spam folder weekly.

What to do next

Once comments are under control, the next question for a growing blog is usually how to bring in more real readers. Our guide on how to promote a WordPress blog covers the basics. If you want partner articles from sites of a similar level and topic, you can connect your WordPress site to Satelo in one click: the plugin publishes partner posts you approve, with links marked rel="sponsored", so outbound links stay labeled just like your comment links. Satelo is a public beta with a small network, so treat it as one extra channel, not a traffic promise.

FAQ

Why am I suddenly getting so many spam comments on WordPress?

Bots find new blogs through search and link lists, and once your site appears in their lists, spam often rises fast. Old posts with open comments and pingbacks turned on are frequent targets.

Can I stop WordPress comment spam without a plugin?

Partly. Turn off pingbacks and trackbacks, require a previously approved comment, hold comments with one link, and close comments on old posts. A honeypot or cloud filter still catches far more bot spam than settings alone.

Is Akismet free?

According to its wordpress.org page, Akismet keys are free for personal blogs, while businesses and commercial sites need a paid subscription.

Is Antispam Bee better than Akismet?

Neither is better for everyone. Antispam Bee works locally with a honeypot and is free for commercial sites too; Akismet uses a cloud database and sends comment data to its servers. Choose by privacy needs and site type.

Do spam comments hurt SEO?

Google lists comment spam as user-generated spam in its spam policies. Published spam is content on your pages, so it is worth removing even though WordPress already marks comment links as nofollow ugc.

Should I disable comments completely?

Only if you do not want discussion at all. For most blogs, closing comments on old posts and moderating first-time commenters removes most spam without losing real readers.

Read next

Best Blogging Platform for SEO: An Honest Comparison by CriteriaThe best blogging platform for SEO is the one that gives you your own domain, HTML control and an easy exit. WordPress, Ghost, Substack and others compared.

How to Promote a WordPress Blog: A 14-Step Plan for the First 90 DaysHow to promote a WordPress blog in its first 90 days: settings to fix, sitemaps, IndexNow, content structure, email, communities and partner posts, in 14 steps.

IndexNow on WordPress: How to Set It Up and What It Does (and Doesn't) DoHow to set up IndexNow on WordPress with the official plugin, Rank Math or Yoast, check that pings work in Bing Webmaster Tools, and what it does for Google.

How to Add llms.txt to WordPress (and What It Will Not Do)How to add llms.txt to WordPress with Yoast, Rank Math, a dedicated plugin or by hand, what a small blog should put in it, and what the file will not do.