Spam bots find every WordPress site sooner or later and fill comments and contact forms with links. Besides the annoyance, thousands of spam comments bloat the database and slow down the dashboard. A few settings and one good plugin stop almost all of it.
Before you start
- Decide whether you need comments at all. Many business sites do not, and switching them off removes the problem completely.
- Administrator access to WordPress.
Turn off comments where you do not need them
- Go to Settings → Discussion.
- Untick Allow people to submit comments on new posts.
- Untick Allow link notifications from other blogs (pingbacks and trackbacks).
- For existing posts, go to Posts → All Posts, select all, choose Bulk actions → Edit and set Comments to Do not allow.
Tighten discussion settings
If you keep comments, these settings in Settings → Discussion help:
| Setting | Recommended |
|---|---|
| Users must be registered and logged in to comment | For communities; stops nearly all bots |
| Automatically close comments on posts older than | 30 to 90 days |
| Comment must be manually approved | On for small sites |
| Comment author must have a previously approved comment | On |
| Hold a comment in the queue if it contains | 2 or more links |
| Disallowed Comment Keys | Common spam words and domains |
Install an anti-spam plugin
- Akismet: checks comments against a large spam database; needs an API key (free for personal sites).
- Antispam Bee: free, works locally without sending data to an external service, good for privacy-focused sites.
- Use only one comment anti-spam plugin to avoid conflicts.
Protect contact forms
- Enable the honeypot field in your form plugin (Contact Form 7, WPForms, Fluent Forms and others have one). It is invisible to people but bots fill it in.
- Add a CAPTCHA if spam continues: Cloudflare Turnstile, hCaptcha or Google reCAPTCHA. Turnstile and invisible reCAPTCHA do not annoy real visitors.
- Do not show your raw email address on the page; let the form send it.
Clean up existing spam
- Go to Comments → Spam and click Empty Spam.
- Check Comments → Pending, select obvious spam and choose Bulk actions → Mark as spam.
- For tens of thousands of comments, use WP-CLI:
wp comment delete $(wp comment list --status=spam --format=ids) --force. - Optimise the database afterwards with LiteSpeed Cache → Database → DB Optimizer.
Registration spam
If fake user accounts appear, check Settings → General → Membership. Untick Anyone can register unless you need public registration, and make sure New User Default Role is Subscriber, never Administrator.
Troubleshooting
- Real comments end up in spam: check the spam folder weekly and click Not Spam; the plugin learns from it.
- Spam keeps arriving with comments off: bots post directly to
wp-comments-post.php. A comment-disabling plugin or a rule blocking that file stops it. - Form notifications missing after adding CAPTCHA: the CAPTCHA keys are wrong or the domain is not registered with the provider.