How to Stop Comment and Form Spam in WordPress

This guide shows you how to cut comment and form spam on your WordPress site down to a trickle, using a layered approach that starts with the free settings already built into WordPress and adds stronger defences only where you need them. It covers the settings on the Discussion screen, honeypot fields, CAPTCHA and invisible challenges, rate limiting, and hosted spam-filtering services, and it explains where each one helps and where each one falls short. Comment spam, contact-form spam, and fake user registrations are all the same problem wearing different clothes: unwanted, usually automated submissions aimed at your public forms. The advice here treats them together. It is written for Noiz clients who run their own WordPress site, and it deliberately names categories of tool and gives specific products only as examples, never as endorsements, because the right mix depends on your site.

Last reviewed: 27 July 2026, against WordPress 7.0.2 (latest stable). This guide is written for Noiz hosting and is kept current against WordPress. It complements, and does not replace, the official WordPress documentation linked below.

Official Documentation Reference

• Understanding comment spam (WordPress Documentation): WordPress's own overview of what comment spam is and the built-in settings for fighting it.
• Settings Discussion screen (WordPress Documentation): the full reference for every option under Settings > Discussion, including moderation, the link limit, and the disallowed keys box.
• Comment moderation (WordPress Documentation): how the moderation queue works and the exact difference between the moderation list and the disallowed comment keys list.
• Anti-spam plugins (WordPress Plugin Directory): the directory's anti-spam tag, where you can compare plugins by last-updated date, compatibility, and support activity.

Prerequisites

• You can log in to your WordPress admin dashboard as an Administrator. Changing discussion settings and installing plugins both need administrator rights.
• A recent, restorable backup of your site. None of the built-in settings here are risky, but you will be installing and configuring plugins, and a backup is your safety net.
• For CAPTCHA and some spam-filtering services, a free account with the provider (for example a Cloudflare account for Turnstile, or an Akismet key). You can set these up as you go.

How Spam Reaches Your Site, and Why One Defence Is Never Enough

Almost every form you expose to the public is a target: the comment box under your posts, your contact form, the registration form if you allow sign-ups, and even the WordPress login page. The great majority of what hits them is not a person picking on you. It is bots working through millions of sites in bulk, filling in every field they can find, usually to plant links, harvest an inbox, or test stolen passwords. A smaller share is posted by hand, by people paid to place spam, and those submissions look far more like the real thing.

That split is the whole reason this guide is built in layers. No single measure stops everything. A honeypot quietly defeats simple bots but does nothing against a human spammer. A CAPTCHA raises the bar for automated tools but adds friction for real visitors and can be beaten by paid solving services. Content filtering catches the manual spam a honeypot misses but sends your visitors' words to a third party. Each layer covers a different gap, and the sensible goal is not a single perfect wall but several cheap, overlapping filters, so that anything slipping past one is usually caught by the next. Start with the free built-in settings, which cost nothing and already remove a surprising amount, then add the stronger layers only if spam is still getting through.

Layer One: Tighten WordPress's Built-in Comment Settings

Before you install a single plugin, work through Settings > Discussion. Everything in this section is part of WordPress core, costs nothing, and on a low-traffic blog is often enough on its own. These settings decide what happens to a comment the moment it is submitted.

Decide What Happens Before a Comment Appears

In the Before a comment appears section there are two checkboxes, and they set the tone for everything else.

• An administrator must always approve the comment. Tick this and nothing goes live until you approve it by hand. This is the single most effective anti-spam setting WordPress offers, because spam is never published, only queued. The trade-off is real work: every genuine comment also waits for you, and a busy comment section becomes a chore. It suits low-volume sites and sites where a delay before comments appear does not matter.
• Comment author must have a previously approved comment. A gentler middle ground. The first comment from any given email address is held for you to approve; once you have approved someone, their later comments appear straight away. This lets a real community flow while still catching the first submission from every new address, which is where most spam comes from.

If you would rather not check both, the second option alone is the better default for most sites: it filters newcomers without turning you into a full-time moderator.

Require a Name and Email, and Consider Requiring Registration

Under Other comment settings, ticking Comment author must fill out name and email forces a little extra work on the submitter. It is worth knowing exactly what this does and does not do: WordPress does not verify the address in any way, so a bot can invent one. What it does is reject the crudest bots that submit with empty fields, at almost no cost to genuine commenters, who expect to give a name and email anyway.

A stronger option in the same box is Users must be registered and logged in to comment. This shuts out anonymous spam entirely, but it also shuts out most of your real readers, who will not create an account just to leave one comment. Reserve it for membership sites and internal sites where visitors already have logins. On an open blog it usually costs you more genuine engagement than it saves you spam.

Hold Comments That Carry Too Many Links

Spam exists to place links, so the number of links in a comment is one of the oldest and most reliable signals. In the Comment Moderation section, the field Hold a comment in the queue if it contains [X] or more links holds anything with that many links or more. WordPress ships with this set to 2. Because a normal comment rarely needs more than one link, lowering the threshold to 1 catches noticeably more junk, at the price of occasionally holding a legitimate comment that happened to include a couple of references. Held comments are not deleted, only queued, so this setting is low-risk: the worst case is a genuine comment waiting a little longer for you to approve it.

Understand the Two Word Lists (and the Gotcha That Bites People)

WordPress gives you two separate text boxes for filtering by content, and confusing them is a genuine hazard. Both match against the comment text, author name, URL, email, IP address, and the browser's user-agent string, one entry per line.

• The Comment Moderation box (the larger text area in that section) holds matching comments for your review. Nothing is lost. This is the safe box, and the right place for words, phrases, spammy domains, or IP addresses you want a second look at rather than an automatic verdict.
• The Disallowed Comment Keys box (named Comment Blacklist before WordPress 5.4) deletes matching comments immediately and silently. There is no notification and no trash: the comment simply never exists as far as you are concerned.

That silent deletion is exactly the gotcha to respect. A genuine comment that happens to contain a word on your disallowed list vanishes without you or the author ever knowing. Use the disallowed box only for terms you would trash every single time without a second thought, such as a specific spam domain or a particular fake brand name that only ever appears in spam. Keep everyday words such as free, deal, or buy out of it entirely, and put anything you are less than certain about in the moderation box instead.

There is a second, subtler trap in both boxes: matching happens inside words, not just on whole words. WordPress's own documentation gives the example that press will match WordPress. So a short entry like ass would also flag class, assessment, and passport, quietly holding or deleting perfectly innocent comments. Prefer longer, distinctive strings, and after adding new moderation words use the Check past comments against moderation list link beneath the box to see what your rule would have caught, before it starts catching real comments.

Close Comments on Older Posts

A large share of automated comment spam lands on old posts that no genuine reader is still discussing. In Other comment settings, Automatically close comments on articles older than [X] days switches the comment form off on any post past that age. Setting it to something like 30 or 60 days removes a huge target with almost no downside, since real conversation on a post nearly always happens in its first few weeks. Previously approved comments stay visible; only new ones are prevented.

Turn Off Pingbacks and Trackbacks

This is the spam source people forget, because it does not look like a comment. Pingbacks and trackbacks are automatic notifications between blogs, and they are almost universally abused to inject spam links that then appear in your comment area. Unless you deliberately rely on them, untick Allow link notifications from other blogs (pingbacks and trackbacks) under Default article settings. Note the same catch WordPress documents for comments: this applies only to posts published from now on. To silence pingbacks on existing posts you either edit each one or make a bulk change, so it is best set early in a site's life.

Disable Comments Where You Do Not Need Them

The most complete defence against comment spam is to have no comment form to attack. Many business sites, brochure sites, and landing pages have no reason to accept comments at all. You can turn comments off for new content by unticking Allow people to post comments on new articles, and switch them off on individual posts and pages through the Discussion panel in the editor, or in bulk from the Posts screen. If your site simply does not host discussion, closing comments site-wide removes an entire category of spam in one move.

Layer Two: Add a Honeypot

Once the built-in settings are in place, a honeypot is usually the best next step, because it costs your real visitors nothing at all. A honeypot is a decoy form field that is hidden from people but visible to bots. A human never sees it, because it is concealed with CSS or positioned off-screen, so they never fill it in. Many automated bots read the raw HTML and dutifully complete every field they find, including the trap. If that hidden field arrives with anything in it, the submission is almost certainly a bot and is silently rejected. The bot moves on believing it succeeded, and you never see the spam.

The appeal of the honeypot is that it is invisible and frictionless: unlike a CAPTCHA, it asks nothing of your genuine visitors and does not slow them down. Many contact-form tools include a honeypot option you can simply switch on, and there are dedicated honeypot plugins that add the technique across comments and forms site-wide. Some also add a timing check, rejecting any form completed impossibly fast, since a human cannot read and fill a form in under a second but a bot submits instantly.

Two limitations keep the honeypot as a layer rather than a whole solution. First, more sophisticated bots have learned to detect and skip honeypot fields, so it no longer stops everything it once did. Second, a badly built honeypot can cause false positives: a browser password manager or autofill can populate a hidden field and flag a real visitor as spam. A well-made honeypot avoids this by giving the field an innocuous name and marking it correctly for assistive technology (for example with aria-hidden and a tabindex of -1) so screen readers and autofill leave it alone. If you build your own, get those details right; if you use a reputable plugin, they are handled for you.

Layer Three: Add a CAPTCHA or Invisible Challenge

When bots are still getting through, a challenge that tries to tell humans and machines apart is the next layer, most often applied to comment, contact, registration, and login forms. The technology has moved on a long way from the twisted-letters image everyone remembers, and the choices in 2026 sit on a spectrum from fully invisible to actively interactive. WordPress does not include any of these in core, so all of them are added with a plugin, and each is a hosted service that needs a free account with its provider. The main options, given as examples rather than recommendations, are:

• Invisible or low-friction challenges run in the background and score how likely a visitor is to be a bot, only showing a puzzle when something looks suspicious. Cloudflare Turnstile is a widely used example: it is free with no monthly cap, works without tracking cookies, and for most low-risk and medium-risk forms it is the least intrusive option, which is why it is a common default. Google reCAPTCHA offers a similar invisible mode and is the most established name, though its free tier is capped and it relies on Google's cookies, which has privacy implications discussed below. hCaptcha is another established alternative that positions itself on privacy.
• Interactive challenges ask the visitor to tick a box, or occasionally to complete a small puzzle, when the risk score is high. They catch more determined bots on high-value forms, at the cost of visible friction for genuine users.

Three practical points matter more than which brand you pick. First, friction versus catch rate is a genuine trade-off: the harder a challenge is for bots, the more it annoys real people, and every extra step loses you some genuine submissions. Match the strength to the target, using a light invisible check on a comment box and reserving anything more aggressive for a login or checkout. Second, privacy and consent: any CAPTCHA sends some visitor data to a third party, and the tracking-based services in particular may require a cookie-consent notice under data-protection rules such as the POPIA and GDPR, whereas the cookieless options are generally easier to deploy without a consent banner. Third, accessibility: image and audio puzzles can be a real barrier for visitors with disabilities, which is another reason the invisible, score-based approach has become the sensible default for most sites.

Layer Four: Rate Limiting and Timing Checks

Rate limiting attacks the volume of spam rather than its content. The idea is simple: a real person submits a form now and then, whereas a bot may hammer it dozens of times a minute. By capping how many submissions are accepted from one source in a given window, and by rejecting anything submitted suspiciously quickly, you blunt automated abuse without asking your visitors to do anything.

Rate limiting shows up in a few places, working together:

• Form and login throttling at the application level. Many form plugins and most security plugins can limit repeated submissions from the same address, and can lock out or slow down repeated failed logins, which is the same problem aimed at your login page rather than a comment box.
• Timing checks that reject a form completed faster than any human could manage, as mentioned under honeypots. This is a form of rate limiting on a single submission and catches instant-fire bots cheaply.
• Server-level protection. Noiz hosting includes abuse protection at the network and server layer that absorbs a good deal of automated traffic before it ever reaches WordPress, so much of the crudest, highest-volume flooding is filtered out for you. This does not replace the in-application layers above, which see the actual form contents, but it means the load reaching your site is lighter than the raw internet would otherwise throw at it.

The trade-off to watch is legitimate users sharing an address. Visitors behind a shared office connection, a mobile carrier, or a corporate network can all appear to come from one IP, so set limits generously enough that a genuine burst of real activity is not mistaken for an attack.

Layer Five: A Spam-Filtering Service for the Spam That Looks Real

The layers so far are strongest against automated spam. What they struggle with is the hand-written spam that behaves like a real submission: correct fields, human timing, no obvious link flood. Catching that reliably means judging the content, and the practical way to do it is a hosted spam-filtering service that compares each submission against a constantly updated database of spam seen across many sites, combined with behavioural analysis.

Akismet is the best-known example and ships bundled with many WordPress installations, which makes it the default many people reach for; it is made by the company behind WordPress.com. It is offered here purely as an example of the category, not as an endorsement, and there are several comparable services, some of which advertise handling spam without sending as much data off-site. Two things are genuinely worth knowing before you turn one on:

• Licensing. Akismet's free tier is intended for personal, non-commercial sites. If your site sells anything, carries ads, or is otherwise a business, its terms require a paid plan. Read the current terms for whichever service you choose so a commercial site is correctly licensed.
• Privacy. These services work by sending the submitted content, along with details such as the commenter's IP address and email, to a third party for a verdict. That is how they achieve their accuracy, but it is a data-sharing decision you are making on your visitors' behalf, and it may need mentioning in your privacy policy to stay compliant with the POPIA and similar rules. The cookieless, less data-hungry alternatives exist partly to soften this.

Used well, a content-filtering service is the layer that mops up what everything else misses, sorting suspected spam into a dedicated queue you can empty in one click rather than moderating each comment by hand.

Protecting Contact Forms and Other Forms, Not Just Comments

Everything above applies just as much to contact forms, quote requests, newsletter sign-ups, and registration forms as it does to the comment box, and it is easy to secure comments while leaving a contact form wide open. A few form-specific measures are worth adding:

• Turn on the anti-spam features your form tool already has. Most reputable form plugins include a honeypot and a CAPTCHA integration in their settings; the commonest mistake is simply never switching them on. Enable the honeypot at minimum, and add a CAPTCHA on forms that attract abuse.
• Validate and constrain fields. Requiring a properly formatted email, setting sensible minimum and maximum lengths, and rejecting fields that should never contain a URL all quietly defeat a lot of low-effort bots. The more specific your form is about what it accepts, the less generic spam fits through it.
• Only ask for what you need. Every extra open field is another thing for a bot to stuff with links. A lean form is a smaller target.
• Guard the registration and login forms. If you allow user registration, apply a CAPTCHA to the sign-up form, since fake accounts are a common goal. Protecting the login form with a challenge and with rate limiting also slows password-guessing, which sits alongside spam as part of the same automated nuisance.

Putting It Together: A Sensible Stack

You do not need every layer, and piling all of them on at once adds friction and complication for little extra gain. Build up only as far as your spam problem requires.

• Most small sites and blogs. Configure the built-in Discussion settings well (require a previously approved comment, hold comments with one or more links, close comments on old posts, turn off pingbacks) and add a honeypot. This costs your visitors nothing and removes the overwhelming majority of spam.
• Sites still getting spam, or with busy public forms. Add an invisible CAPTCHA to comments and forms, and turn on rate limiting or a security plugin that provides it. This handles the more persistent bots.
• Sites with real discussion, commercial sites, or anything still seeing hand-written spam. Add a content-filtering service on top, correctly licensed and noted in your privacy policy, to catch the human-quality spam the automated layers cannot.

Spam control is one item on a wider list of things worth keeping tidy on a WordPress site. It sits alongside the other measures in the Noiz WordPress Security Checklist, which is worth working through in full.

Troubleshooting

• Symptom: genuine comments are disappearing entirely, with no trace in the queue or trash. A word in the comment matched your Disallowed Comment Keys list, which deletes silently. Review that box, remove anything broad, and remember that matching happens inside words, so a short entry can catch innocent text. Move anything uncertain to the Comment Moderation box, which only holds rather than deletes.
• Symptom: every comment, even obviously real ones, is going to the moderation queue. Check Settings > Discussion: either An administrator must always approve the comment is ticked, or your link limit is set very low, or a common word is on your moderation list. Adjust whichever is over-catching.
• Symptom: real visitors report that your contact form rejects them as spam. A honeypot is likely being triggered by a browser autofill or password manager filling the hidden field, or a timing check is too aggressive. Update to a honeypot implementation that marks the field correctly for autofill and assistive technology, and loosen any minimum-time threshold.
• Symptom: you turned off comments in settings but old posts still receive spam. WordPress applies that change only to content published afterwards. Close comments on existing posts individually in the editor, or select them all on the Posts screen and use Bulk actions > Edit to set comments to Do not allow.
• Symptom: your CAPTCHA is visible and annoying real visitors on a low-risk form. You are probably using an interactive mode where an invisible, score-based mode would do. Switch the widget to its invisible or managed mode, and reserve visible challenges for high-value forms such as login or checkout.
• Symptom: spam stopped for a while, then came back. Spammers adapt, and a single layer that worked last year may have been defeated. Add another layer rather than replacing the one that slipped, since defence in depth is what holds up over time.

If spam is overwhelming your site, or you would like help choosing and configuring the right combination of these layers for your traffic, open a support ticket with the Noiz support team. Include your domain, which forms are being hit (comments, contact form, registrations, or login), and roughly how much spam you are seeing, and a technician can help you put a proportionate defence in place.