How to Stop WordPress Spam Comments (Complete Guide + AI Method)

To stop WordPress comment spam, hold first-time commenters for approval in Settings → Discussion, remove the link incentive (the Website field and live links), put a bot gate like a honeypot or Cloudflare Turnstile on the comment form, and run one content filter such as Akismet or Antispam Bee. Each layer catches what the one before it misses.

Below is each layer with the exact setting labels from WordPress 7.1, a few behaviors I tested that the settings screen does not make obvious, a plugin comparison with prices checked in November 2026, and how to clear out spam you already have.

The four layers at a glance

Layer	What it stops	Cost	Where
Discussion settings	Drive-by spam from new commenters, link-heavy comments, spam on old posts	Free	Settings → Discussion
Remove the link incentive	Backlink spam (the most common kind)	Free	A small snippet
Bot gate	Automated form submissions before they reach WordPress	Free	Honeypot plugin or Turnstile
Content filter	Spam that gets through, judged on content and reputation	Free to paid	Akismet, Antispam Bee, CleanTalk, RightComments

Layer 1: tighten Settings → Discussion

Everything in this section is built into WordPress. I checked each label on a fresh WordPress 7.1.4 install in WordPress Playground, so the wording below matches what you will see.

Setting (exact label)	Section	What I recommend
Comment author must have a previously approved comment	Before a comment appears	On. First-time commenters wait for you; returning commenters post instantly.
Comment must be manually approved	Before a comment appears	Only if you want to read every comment first. It overrides every other check.
Comment author must fill out name and email	Other comment settings	On (it is on by default).
Users must be registered and logged in to comment	Other comment settings	Only for membership or community sites.
Automatically close comments on old posts	Other comment settings	On, with a days value that fits how long your posts get real replies.
Allow link notifications from other blogs (pingbacks and trackbacks) on new posts	Default post settings	Off.
Number of links to allow in a comment before holding for moderation	Comment Moderation	1 if you want any comment with a link held.
Disallowed Comment Keys	Disallowed Comment Keys	A short list of phrases and IPs you never want.

1. Hold first-time commenters

Check Comment author must have a previously approved comment under “Before a comment appears.” A new name and email combination goes to the moderation queue; once you approve one comment from someone, their next ones publish without waiting. This is the setting SmartWP runs with, and it is the best trade-off I know between spam control and not making regulars wait.

Comment must be manually approved is the stricter version. In core, it short-circuits every other check and holds everything, which works but gets tedious past a few dozen comments a week.

2. Set the links threshold correctly (0 does not mean zero links)

Most spam exists to plant links, so WordPress can hold link-heavy comments. The setting is labeled “Number of links to allow in a comment before holding for moderation” and defaults to 2. The label is easy to misread, so I tested it on WordPress 7.1.4 with comments containing zero, one and two links:

Setting value	0 links	1 link	2 links
0	Approved	Approved	Approved
1	Approved	Held	Held
2 (default)	Approved	Approved	Held

Two things stand out. A value of 0 switches the check off entirely (the core code only runs it when the value is set), so it is the least strict option, not the most. And the comparison is “this many or more,” so 1 holds any comment with a single link.

Plain-text URLs count too. WordPress runs the comment through its comment_text filters before counting, which turns a bare https://... into a link, so a comment with an unlinked URL was held at a setting of 1 in my test.

3. Comment Moderation keys vs Disallowed Comment Keys

Both boxes take one word, phrase or IP address per line, and both check the comment content, author name, URL, email, IP address and browser user agent. The difference is what happens on a match:

• A match in the Comment Moderation box holds the comment in the moderation queue.
• A match in Disallowed Comment Keys sends the comment straight to the Trash. In my test, both a phrase in the content and a listed IP address went to Trash, not Spam.

Both match inside words. WordPress’s own help text warns that “press” will match “WordPress,” and in my test a disallowed entry of casino bonus also trashed a comment that said “casino bonuses.” Use full phrases, not single short words, in the Disallowed box. Words like “free” or “download” appear in plenty of real comments.

A good split: put the obvious junk (pharma terms, casino phrases, known spam IPs) in Disallowed Comment Keys, and put the borderline stuff in Comment Moderation. Generic praise like great guide is a good moderation key, because link-drop spam often opens that way but a real reader might write it too. When I added it to the moderation box, a comment containing it was held rather than trashed.

4. Close comments on older posts

Check Automatically close comments on old posts and fill in “Close comments when post is how many days old” (the box shows 14 when you first turn it on). Spam bots keep hitting old posts long after real readers stop replying, so this cuts a lot of noise on an older blog.

Two details from core: the check happens when the post is viewed, so it applies to existing posts right away, not only new ones. And by default it only covers the post post type. Pages and custom post types keep their comments open unless a plugin or the close_comments_for_post_types filter adds them.

5. Turn off pingbacks and trackbacks

Uncheck Allow link notifications from other blogs (pingbacks and trackbacks) on new posts under “Default post settings.” Pingbacks are mostly a spam channel at this point.

As the label says, this only affects new posts. For existing posts, go to Posts, select them, choose Edit under Bulk actions, and set Pings to “Do not allow.”

6. Require registration (for community sites)

Users must be registered and logged in to comment stops nearly all automated comment spam, because bots rarely complete a signup. The cost is that one-time readers will not bother either. It makes sense on membership or community sites; on a regular blog, holding first-time commenters gets you most of the benefit with less friction. If you open signups, keep new accounts at the Subscriber role (see WordPress user roles for what each role can do).

For finer control like minimum and maximum comment length, I have a separate guide on limiting comment length in WordPress.

Layer 2: take away the link incentive

7. Remove the Website field from the comment form

Most comment spam is a backlink play, so remove the Website (URL) field. This uses the comment_form_default_fields filter hook. Add it to a code snippets plugin, your child theme’s functions.php, or a small mu-plugin:

add_filter( 'comment_form_default_fields', function ( $fields ) {
    unset( $fields['url'] );
    return $fields;
} );

I tested this on WordPress 7.1.4 by rendering the comment form for a logged-out visitor: it still showed the Name and Email fields, and the Website field was gone. Logged-in users never see these fields anyway.

Note that this only changes the form. A bot posting straight to wp-comments-post.php can still send a URL, which is why SmartWP also strips URLs from the comment author and comment text with a small mu-plugin. Whatever links do get through already carry rel="ugc external nofollow" on the author name (I checked the output of get_comment_author_link()), so approved spam passes no ranking value, but it still looks bad to readers.

Layer 3: stop bots before they submit

8. Add a honeypot

A honeypot is a form field hidden from humans with CSS. Bots fill in every field they find, so a filled honeypot means a bot. Real readers never see a challenge.

Antispam Bee works this way: its documentation lists “Bot entered data into the hidden (honeypot) comment field” as one of its spam reasons. CleanTalk and other anti-spam plugins also include bot checks that run without a visible challenge.

9. Cloudflare Turnstile or reCAPTCHA

If a honeypot is not enough, add a challenge. Cloudflare Turnstile is free, usually invisible to real visitors, and works whether or not your site uses Cloudflare for DNS. The free Simple CAPTCHA with Cloudflare Turnstile plugin has a toggle for the WordPress comment form; my walkthrough on adding Cloudflare Turnstile to WordPress covers the setup.

Google reCAPTCHA v3 is also invisible and works fine. I lean toward Turnstile because it does not load Google’s scripts on every page with a comment form.

10. Block bots at the edge

If your site already runs through Cloudflare, Bot Fight Mode is a free switch under Security Settings (filter by Bot traffic). It challenges requests that match bot patterns before they reach WordPress. Cloudflare’s documentation warns it can also challenge API or mobile app traffic and cannot be skipped with WAF rules, so test anything that calls your site’s REST API after turning it on.

Layer 4: pick one content filter plugin

Bot gates stop scripts. Content filters judge the comments that still come through. Prices and install counts below were checked on the vendor sites and WordPress.org on November 9, 2026.

Plugin	How it filters	Price	Data sent off-site	Active installs
Akismet	Cloud check against Akismet’s spam network	Personal: name your price (non-commercial only). Pro from $9.95/mo billed yearly (500 checks/mo, 1 site)	Yes, comment data goes to Akismet	5 million+
Antispam Bee	Local rules, honeypot, local spam database	Free	No by default (optional country, language and Gravatar checks use outside services)	700,000+
CleanTalk	Cloud reputation database, invisible checks, firewall	$12/year for 1 site, 7-day free trial	Yes	200,000+
RightComments	AI reads each comment in context	Basic: $8.99/mo or $74.99/year for 1,000 comments/mo; free start, no card	Yes, scanned on RightComments’ servers	Not on WordPress.org
Simple CAPTCHA with Cloudflare Turnstile	Bot challenge, not a content filter	Free	Yes, to Cloudflare	200,000+

Akismet: free only for non-commercial sites

Akismet ships with WordPress (it was in the plugins folder of my 7.1.4 install), but bundled does not mean free for everyone. Akismet’s free-or-paid guidance says Personal keys do not support commercial activity, and lists examples: ad code like AdSense, affiliate links, live chat, promoting a business or service, accepting donations, and e-commerce plugins. If any of those describe your site, you need a paid plan.

Two settings worth knowing: Akismet can “Silently discard the worst and most pervasive spam so I never see it” or “Always put spam in the Spam folder for review,” and it deletes spam older than 15 days on its own (adjustable with the akismet_delete_comment_interval filter).

Antispam Bee: the free, local option

Antispam Bee runs its checks on your own server, with no account or API key. Options include trusting commenters who already have an approved comment, checking comment timing, and deleting stored spam after a set number of days. It is a good default if you want to avoid sending comment data to a third party.

Run one content filter, maybe two that work differently. Stacking several cloud filters mostly adds slower comment submits and more places to look when a real comment goes missing.

AI-written spam and RightComments

Pattern-based filters key on links, known bad IPs, repeated text and reputation. Comments written by a language model can read naturally and come from clean IPs, so some slip through. That is the gap RightComments targets: it sends each comment to an AI model that reads it in context, and anything it flags lands in your WordPress spam folder rather than being deleted.

Disclosure: RightComments is made by my company, so weigh that. It is a paid service (the Basic plan covers 1,000 scanned comments a month) and is not on WordPress.org: you add its plugin and paste an API key from your RightComments dashboard. One honest caveat: at its default sensitivity it can let through short, generic “great guide, thanks” praise that exists only to drop a link. The settings in Layers 1 and 2 cover that case, which is the point of running layers instead of trusting one filter.

What SmartWP runs

• RightComments as the main filter, with Antispam Bee and Akismet also installed.
• First-time commenters held for moderation (“Comment author must have a previously approved comment”).
• The Website field removed and URLs stripped from comments through small mu-plugins.

How to delete existing spam comments in bulk

In wp-admin, go to Comments, open the Spam tab and click Empty Spam. The Trash tab has a matching Empty Trash button. If spam got approved, select those comments, choose “Mark as spam” from Bulk actions, then empty the Spam tab.

For big backlogs, WP-CLI is faster. This deletes every comment in the spam queue permanently:

wp comment delete $(wp comment list --status=spam --format=ids) --force

I ran this on a WordPress 7.1.4 test site: it deleted the three spam comments and left the approved one alone. Without --force, the comments go to the Trash instead. If there is no spam, the inner command returns nothing and WP-CLI prints a usage error, which is harmless.

Or disable comments entirely

If your posts rarely get real discussion, turning comments off is a reasonable call. Uncheck “Allow people to submit comments on new posts” in Settings → Discussion for new posts; for existing ones, the Disable Comments plugin handles everything at once. My guide on how to disable comments in WordPress covers every method, including WP-CLI and cleaning up the leftover admin menus.

Why spam comments are worth stopping

• Google’s spam policies list “comment spam on blogs” as user-generated spam, and say sites that violate the policies may rank lower.
• Readers are less likely to comment when the existing comments are junk.
• Spam links often point to phishing or malware pages, which is a risk to your visitors.
• Years of unchecked spam bloat the comments table.

---

Frequently asked questions

---

Bottom line

For most sites: turn on “Comment author must have a previously approved comment,” set the links threshold to 1, close comments on old posts, remove the Website field, add a honeypot or Turnstile, and run one content filter. Then empty the Spam tab once and let the layers keep it that way.