If your site has comments open, it gets spam. Most of it is automated: bots posting links to improve someone else’s search rankings or spread malware. You can stop nearly all of it in about fifteen minutes.
Step 1: Decide if you need comments at all
Many business sites do not. If yours does not, turn them off entirely:
- Go to Settings → Discussion and uncheck “Allow people to submit comments on new posts.”
- Turn off comments on existing posts: go to Posts → All Posts, select all, choose Edit from bulk actions, and set Comments to “Do not allow.”
- Delete the spam already waiting under Comments → Spam and Pending.
A plugin like Disable Comments does all of this at once, including on pages and media.
Step 2: Tighten the discussion settings
If you keep comments, go to Settings → Discussion and set:
- “Comment author must have a previously approved comment” (first-time commenters wait for approval)
- “Hold a comment in the queue if it contains 2 or more links”
- “Automatically close comments on posts older than 30 days” (old posts attract the most spam)
- Uncheck “Allow link notifications from other blogs (pingbacks and trackbacks)”
Step 3: Add a spam filter
- Akismet, made by Automattic, checks every comment against a large spam database. Free for personal sites; commercial sites need a paid plan.
- Antispam Bee is free for any site, does not need an account, and is privacy-friendly.
- A hidden CAPTCHA such as Cloudflare Turnstile adds a check that real visitors never see.
Forms get spam too
Contact form spam is a separate problem. Gravity Forms has built-in honeypot protection plus add-ons for Akismet and Turnstile. Turn those on for every public form.
Let us handle it
Spam protection and form security are part of every Care Plan. If your comment queue is already buried, our $79 one-time fix will clean it up and lock it down.