The most reliable way to stop WordPress comment spam is to combine built-in Discussion settings with selective moderation, per-post comment controls, and an anti-spam plugin. Start at Settings → Discussion: require approval when control matters, hold comments with multiple links, add recurring spam patterns to the moderation list, use the blocklist only for certain abuse, and close comments on content that does not need them. Add automated filtering such as Akismet when manual screening is no longer practical, but continue reviewing the queue because no setting prevents bots from sending requests.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What WordPress comment-spam controls can and cannot do
Comment spam usually arrives through automated submissions rather than through readers who misunderstand your site. A bot can continue posting requests even after you tighten publication rules. WordPress’s own documentation says its built-in settings can reduce some automated spam but may not stop every spammer. The practical goal is therefore to keep unwanted comments from being published, reduce the number that reach your moderation queue, and make legitimate discussion easy enough to review.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →WordPress gives you several layers of control:
- Publication control: comments can require approval before appearing.
- Pattern screening: comments containing selected words, domains, names, email addresses, IP addresses, or links can be held for review.
- Automatic rejection: high-confidence matches can be sent directly to spam.
- Scope control: comments can be closed on one post or on many existing posts in bulk.
- Service-based filtering: a plugin can analyze submissions against a larger spam-detection system.
Use the least restrictive combination that gives you a manageable queue. Very broad word lists and low link thresholds can catch more spam, but they also increase false positives and make real commenters wait.
Audit your current Discussion settings first
Open the site-wide defaults
- Sign in to the WordPress administrator dashboard.
- Open Settings → Discussion.
- Review whether comments are enabled by default for new posts and pages.
- Check whether pingbacks and trackbacks are enabled by default.
- Save any changes before moving to the more specific moderation fields.
These options generally establish defaults for new content. Changing the default comment setting does not necessarily close comments on posts that already exist; those posts may retain their individual status. Treat existing content as a separate cleanup task.
Decide whether pingbacks and trackbacks belong on your site
Pingbacks and trackbacks are separate from ordinary reader comments and can attract their own automated noise. If you do not use them for editorial or networking purposes, disabling them in Discussion settings removes an unnecessary submission channel. If you keep them, include them in your queue review rather than assuming that a technical-looking notification is legitimate.
Choose an approval policy that matches your risk
Under the comment-approval controls, choose the rule that determines when a comment may publish automatically. The right setting depends on whether your priority is maximum publication control or a low-friction conversation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Policy | How it works | Best fit | Main trade-off |
|---|---|---|---|
| An administrator must always approve the comment | Every comment stays pending until an administrator approves it. | News, business, regulated, high-visibility, or heavily targeted sites. | Every genuine comment creates review work and a delay before publication. |
| Comment author must have a previously approved comment | A new identity enters moderation; later comments from an author with an approved comment can pass more easily. | Communities with returning participants and a moderate spam risk. | A spammer can still pass after an identity has been trusted, and first-time commenters wait. |
| No approval requirement | Comments can publish immediately unless another rule catches them. | Small, low-risk sites where instant conversation matters more than strict control. | Spam can become visible before you remove it. |
For a site receiving persistent spam, start with administrator approval. If the queue becomes predictable and your audience includes repeat commenters, the previously approved-comment rule can reduce workload without opening the door completely. Whatever you choose, retain a regular review routine; approval policy is a publication gate, not a spam detector.
Hold comments that contain too many links
In Discussion settings, enable the option to hold a comment when it contains more than a chosen number of links. Many spam submissions include several hyperlinks, so this is a useful signal even when the text changes from one attempt to the next.
Set the threshold conservatively
Use a low threshold when your audience rarely posts links. Use a higher threshold when readers routinely cite sources, documentation, or several related pages. WordPress warns that legitimate comments containing multiple links can also be held. A held comment is not proof of abuse; inspect the author, wording, destinations, and context before approving it.
Do not treat the link threshold as a universal answer. A spammer can submit a comment with one link, no visible link, or a URL hidden in other metadata. Combine the threshold with moderation terms and an approval policy.
Build a moderation list from patterns you can explain
The Comment Moderation field is for terms that should send a matching comment to the pending queue rather than publishing immediately. Add patterns that recur in your own queue, such as:
- Exact phrases used in repeated promotional comments.
- Domains that appear only in unwanted submissions.
- Email addresses or email domains associated with repeated abuse.
- Names or usernames used by a recurring campaign.
- IP addresses that repeatedly submit the same abuse, when you have enough evidence to avoid blocking a shared legitimate network.
- Other distinctive terms that have little chance of appearing in a genuine comment on your site.
Use narrow entries first
Start with a distinctive phrase or domain rather than a common word. Broad entries can hold normal discussion, product names, technical vocabulary, or quoted text. Review the pending queue after each change and remove entries that create unnecessary work.
Keep a short record of why each entry was added. When a term stops appearing in spam, you can decide whether it still earns its place. When a legitimate commenter is repeatedly held, narrow the pattern instead of asking readers to work around an overbroad rule.
Use the Comment Blocklist only for high-confidence abuse
The Comment Blocklist (also called the disallowed comment keys field in some WordPress documentation) behaves more aggressively than moderation. If a comment matches an entry, WordPress marks it as spam and it can be deleted without warning. WordPress explicitly cautions that genuine comments can be lost this way.
Good candidates for the blocklist
- A domain that exists solely in malicious or irrelevant submissions to your site.
- A distinctive phrase that has no plausible legitimate use in your subject area.
- An abusive email address or IP address that you have verified across multiple attempts and that is not likely to represent a shared network.
Entries that do not belong there
- Common words such as names of products, places, or technologies.
- Generic marketing terms that legitimate readers might use.
- Large lists copied from elsewhere without checking how they match your audience.
When uncertain, put the pattern in Comment Moderation first. A pending item can be inspected; a blocklist match may disappear before you see it.
Close comments on content that does not need discussion
Some pages are better protected by removing the submission surface entirely. Announcements, landing pages, documentation, legal notices, and very old posts may not benefit from an open comment form.
Close comments on one post
- Open Posts → All Posts (or Pages → All Pages).
- Edit the item whose discussion should end.
- In the editor, open the discussion or comments panel.
- Turn off Allow comments and, if shown, Allow trackbacks and pingbacks.
- Update the post or page.
The exact panel placement varies by editor and theme, but the individual content setting overrides the site-wide default for that item.
Close comments in bulk
- Open Posts → All Posts or the corresponding Pages screen.
- Filter or search until the target group is visible.
- Select the items, choose Bulk actions → Edit, and click Apply.
- Set Comments to Do not allow. Set pingbacks or trackbacks to the equivalent disabled option if it is available.
- Save the bulk edit and spot-check several items.
Bulk-closing comments is often cleaner than maintaining an ever-growing blocklist for content that should never have a discussion channel.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Add automated filtering when manual rules are not enough
An anti-spam plugin adds a service or detection layer to the built-in settings. The official Akismet listing says it checks comments and contact-form submissions against a global spam database, filters submissions that look like spam, and keeps a status history for moderators to review.
Install and configure an anti-spam plugin
- In the dashboard, open Plugins → Add New.
- Search for the anti-spam plugin you have selected and verify that its publisher and current compatibility information are appropriate for your WordPress installation.
- Choose Install Now, then Activate.
- Open the plugin’s settings or setup screen from the dashboard menu.
- Complete the requested account or service connection and choose the filtering options that fit your moderation policy.
- Submit a harmless test comment if the plugin provides a testing method, then confirm that normal comments still reach the expected pending or approved state.
Keep the plugin updated through the normal WordPress update process and continue checking its spam queue. Automated filtering reduces screening work; it does not make the site unreachable to spammers or guarantee that every decision is correct.
Do not let the plugin replace editorial review
Inspect filtered items periodically. Approve a legitimate comment when it is misclassified, and use the plugin’s reporting or correction controls when available. If a real reader is repeatedly caught, adjust your built-in moderation terms and link threshold rather than assuming the service is always wrong or always right.
Process the moderation queue as an operating routine
A good configuration still needs a predictable workflow. Review the queue on a schedule that matches your publication frequency and audience expectations.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Open the pending comments screen and sort through new submissions.
- Read the complete comment, not only the first sentence or the link count.
- Approve comments that are relevant and safe, and reply when a response would help the conversation.
- Mark clear spam as spam so WordPress and any connected filter have a useful signal.
- Trash abusive, empty, or irrelevant submissions that do not need to remain in the spam workflow.
- When the same distinctive pattern appears repeatedly, add a narrow term to Comment Moderation or, only when certain, to the blocklist.
Never add a broad term immediately after seeing one bad comment. Confirm that the pattern is specific and that it will not match ordinary language used by your readers.
Compare the main approaches before you tighten everything
| Approach | Publication control | False-positive risk | Maintenance | Coverage | User friction |
|---|---|---|---|---|---|
| Always require administrator approval | Highest; nothing publishes without review. | Low risk of automatic publication, but every legitimate comment enters the queue. | Ongoing queue review. | Applies to all comments regardless of wording. | High; readers wait for approval. |
| Previously approved author rule | Strong for new identities, lighter for returning authors. | Depends on how carefully previous approvals are granted. | Moderate queue review and occasional account-pattern checks. | Combines identity history with normal moderation rules. | Moderate; first comments are delayed. |
| Link threshold | Holds comments over the selected count. | Higher when readers often share several references or the threshold is low. | Adjust threshold as discussion patterns change. | Targets hyperlink-heavy submissions, not every spam type. | Usually low unless link-rich comments are common. |
| Comment Moderation list | Matching comments wait for a decision. | Controlled by how specific each term is. | Requires tuning as campaigns change. | Comment text and matching metadata such as names, email addresses, domains, or IP addresses. | Only affects comments that match. |
| Comment Blocklist | Matching comments are treated as spam and may be deleted immediately. | Highest if entries are broad. | Review entries carefully because recovery may not be possible. | High for exact, known-abuse patterns. | Invisible to legitimate commenters whose content is mistakenly matched. |
| Anti-spam plugin | Automatic filtering with a review history. | Depends on the service and your settings; mistakes remain possible. | Updates, service configuration, and queue review. | Analyzes submissions beyond your local word list. | Usually lower than universal manual approval, but some checks can affect submission flow. |
| Close comments | Removes the comment channel for selected content. | No comment false positives because no comments are accepted. | One-time change, plus periodic review of newly published content. | Only covers the posts or pages you close. | Highest for readers who need to ask a question on that item. |
Fix common comment-spam problems
Spam keeps arriving after you disabled comments by default
Check whether the spam is landing on older posts. The default setting usually affects new content and does not rewrite each existing post’s comment status. Use the individual edit screen or bulk editing to close comments on the older items. Also check whether pingbacks or trackbacks remain enabled.
Comments still appear even though you turned on moderation
Confirm that you changed the correct site and saved the Discussion settings. Then inspect the individual post: its comment status can differ from the default. Check whether an administrator or trusted user is approving comments, and distinguish approved comments from pending items in the dashboard. If a plugin or theme changes comment behavior, temporarily review its settings before loosening the core rules.
Legitimate comments are being held
Review the link threshold and every entry in Comment Moderation. A reader citing several sources can exceed the link limit, while a common word or domain in your list can catch normal discussion. Approve the valid comment, then narrow or remove the rule that caused the match.
Legitimate comments disappear
Inspect the blocklist first. A blocklist match can be deleted without warning, so broad terms may remove comments before you can review them. Move uncertain patterns to Comment Moderation, where they can be inspected before publication.
Spam bypasses your word list
Do not assume that changing a phrase list will catch every variation. Review the newest submissions for repeated domains, names, email addresses, IP addresses, and link patterns. Add distinctive matches to moderation, keep approval required while the campaign continues, and consider an automated anti-spam plugin for analysis beyond local rules.
The queue is too large to manage
Close comments on content that no longer needs them, raise or lower the link threshold based on real false positives, and move only well-understood patterns to the blocklist. If the site still receives more submissions than staff can inspect, add automated filtering and maintain a smaller human review sample rather than publishing everything automatically.
A maintenance plan that keeps spam manageable
After the initial setup
- Confirm the default comment, pingback, and trackback states.
- Choose an approval policy and document who can approve comments.
- Set a link threshold that fits your normal discussion.
- Add a few narrow moderation terms from observed abuse.
- Leave uncertain patterns in moderation instead of the blocklist.
- Close comments on old or transactional content where discussion has no purpose.
- Install and configure an anti-spam plugin if manual filtering is insufficient.
Each week or on a schedule suited to your site
- Review pending, spam, and recently approved comments.
- Look for false positives before adding new blocklist entries.
- Remove obsolete or overly broad moderation terms.
- Check that plugin updates and service connections are current.
- Spot-check older posts for comments that should now be closed.
When spam patterns change
Temporarily favor stronger publication control, collect several examples, and then update the narrowest rule that addresses the pattern. Avoid reacting to one message with a sweeping blocklist entry. Spammers can change wording, domains, and sending addresses, so a layered policy is more durable than a single permanent list.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe practical baseline for most sites
For a general WordPress site, enable administrator approval while spam is active, or use the previously approved-comment rule when returning readers are important. Hold comments that exceed a sensible link count, place recurring phrases and domains in Comment Moderation, and reserve Comment Blocklist for patterns you would never want to see published. Disable comments and pingbacks on content that does not need discussion, including older posts in bulk when appropriate. Add an anti-spam plugin when the volume exceeds what staff can review, and keep checking its decisions. This combination reduces publication risk without pretending that any setting can stop every automated request.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
