How to stop WordPress comment spam

Comment spam on WordPress is almost entirely automated — scripts submitting the comment form thousands of times an hour, looking for a link they can plant. It has nothing to do with what you have written; a brand-new site with no traffic at all gets exactly as much of it as an established one, because the scripts do not read the content, they just find the form.

Start with the built-in Discussion settings

Under Settings → Discussion are several controls that block a large share of spam without installing anything:

• Comment author must fill out name and email. Trivial for a bot to fill in, but it removes the laziest automated submissions.
• Users must be registered and logged in to comment. Effective, but only appropriate for a site where you actually want a registration barrier — it will also stop genuine visitors who are not signed in.
• Comment must be manually approved. Nothing posts publicly until you approve it. Reliable, but a genuine burden on a site that gets a real volume of legitimate comments.
• Comment author must have a previously approved comment. A good middle ground — first-time commenters are held for approval, but people who have already been approved once can post freely afterwards.
• Hold a comment for moderation if it contains a certain number of links. Spam comments are usually link-heavy, since planting a link is the entire point. Setting this to one or two links catches a large share of it automatically.

Add a spam-filtering plugin

Discussion settings reduce volume; a filtering plugin such as Akismet actually classifies each incoming comment against a much larger, constantly updated pattern set than any single site could maintain on its own, and sorts the obvious spam into its own queue automatically rather than mixing it in with genuine comments awaiting approval.

Once it is active and connected, check its queue occasionally rather than assuming it needs nothing further — a false positive holding back a genuine customer comment is rare but worth catching, and marking missed spam manually helps it stay accurate for your specific site over time.

Turn off pingbacks and trackbacks

Pingbacks and trackbacks are an older WordPress feature meant to notify a site when another site links to it. In practice they are now used almost exclusively as a spam vector, since a fake pingback is just another way to plant a link with no actual comment attached. Under Settings → Discussion, untick "Allow link notifications from other blogs" to stop accepting new ones. Existing pingback spam already in your comments can be bulk-deleted the same way as regular spam comments.

Add a simple human check

A basic honeypot or math-style check — "what is 3 + 4?", or a hidden field a script fills in but a human never sees — stops a large share of unsophisticated bots without adding friction for real visitors. Several anti-spam plugins include this as an option, and it is worth turning on in addition to, not instead of, a proper filter like Akismet, since the two catch slightly different things.

If spam is arriving through a contact form instead

Comment spam and form spam are different problems solved differently, even though they often get lumped together. If the junk you are seeing arrives as emails from a contact form rather than as blog comments, see making a website contact form deliver reliably, which covers form-specific spam controls including its own CAPTCHA and honeypot options.

Cleaning up what has already accumulated

Spam comments sitting in the trash or spam folder still take up space in your database and are worth clearing periodically rather than left indefinitely — Comments → Spam has an "Empty Spam" option that deletes everything in the queue in one action. See cleaning up and optimising the WordPress database for dealing with the wider clutter that builds up over the life of a site, spam included.