12+ Vital Tips and Tools to Combat Comment Spam in WordPress

Are you getting tired of dealing with comment spam on your WordPress blog?

You are not alone. Spam comments are a huge problem for any website once you start getting steady traffic.

In this article, we will share the best WordPress comment spam plugins and helpful tips to combat spam comments in WordPress. These tips will save you a lot of time and will significantly reduce comment spam from your website.

Why You Need to Deal with Comment Spam in WordPress

Comment spam is a problem on many WordPress websites. These spammers hope to use your website to improve the search engine ranking of their own sites and get accidental clicks from unsuspecting visitors.

Many of these comments are left automatically by spambots, which are programs designed to comment on blogs and websites. Others are submitted by real people. They’re usually off-topic, poorly written, and contain links to third-party websites.

If you are not monitoring your website and these comments get published, then your actual users and search engines will be able to see them. And this affects your website’s reputation.

Users might consider your website to be low-quality and spammy. And search engines can mark your site as unsafe if any of the comments link to viruses and malware.

That being said, let’s see how you can combat comment spam effectively so that you spend less time worrying about spam and more time growing your online business.

1. Turn On Comment Moderation in WordPress

Let’s first make sure that comments can’t be published on your website without your approval. This step will ensure that comments don’t bypass any filters, and it will also give you full control over which comments appear on your website.

This solution is highly recommended for business websites such as law and accounting firms.

Head over to the Settings » Discussion page of your WordPress admin area. Next, scroll down to the ‘Before a comment appears’ section and check the box next to ‘Comment must be manually approved’.

Don’t forget to click the ‘Save Changes’ button at the bottom of the page.

All your WordPress comments will now be held for moderation, and you will have to manually approve each comment before it appears on your website.

Now, you may be wondering how long it will take to go through all the comments. In the next few tips, we’ll show you how to eliminate spam comments so that the comments you have to moderate will be mainly genuine.

2. Activate Akismet Spam Protection

Akismet is a spam protection plugin that catches the most common types of spam comments. It does this by filtering all WordPress comments on your website through a global spam database.

Akismet comes preinstalled with WordPress, but it is not activated by default.

Personal blogs and small websites can use Akismet free of charge, but you will need to sign up for their API key.

You can learn the correct way to set up the plugin by following our step-by-step guide on how to set up Akismet.

3. Use Sucuri to Combat Spam Comments

Too many requests from comment spammers can slow down your website and affect performance. While Akismet is able to catch a lot of spam comments, it can’t stop spammers from accessing your website.

This is where Sucuri comes in. It is the best WordPress firewall plugin that allows you to block suspicious requests before they even reach your website.

This plugin can prevent automated bots and scripts from submitting comments. This reduces the load on your servers and the number of spam comments you receive.

Learn how Securi helped us block 450,000 WordPress attacks over a three-month period.

4. Use Honeypot to Catch Spambots

Honeypot is a spam prevention technology that tests to see whether a commenter is a bot, rather than asking them to prove they are human. This strategy is inspired by the saying, ‘You can catch more flies with honey than with vinegar.’

Instead of making users perform a reCAPTCHA test to prove they are human, a honeypot provides a challenge that is visible to bots but not humans. If the challenge is attempted, then the commenter is revealed as a bot.

And once they are identified as a bot, they can be blocked before they post a comment.

Antispam Bee is a free honeypot plugin that can effectively identify spambots. It also has settings to trust approved commenters, validate IP addresses, mark BBCode (Bulletin Board Code) links as spam, and check public antispam databases.

You can learn how to set up the plugin in our guide on how to use Antispam Bee to block spam comments in WordPress.

5. Add Google reCAPTCHA Verification

Google ReCAPTCHA is an advanced form of CAPTCHA and can be tested to see whether a user is a bot or human. CAPTCHA stands for ‘Completely Automated Public Turing Test to Tell Computers and Humans Apart’.

Users are required to click a checkbox to demonstrate they are not robots. They will either pass right away or be presented with a second test, a set of images where they have to click on matching objects.

It is difficult for bots to pass the test because when Google detects a spambot, it gives them a much harder challenge. And while users find most CAPTCHA tests annoying, reCAPTCHA provides the best user experience.

You can add reCAPTCHA to the WordPress comment form using the Advanced Google reCAPTCHA plugin. To learn how to set it up, see our guide on how to add reCAPTCHA to the WordPress comment form.

6. Prevent Imposter Comments

When some spammers leave comments, they try to fool you by filling in the username and email address of a registered user on your website. They do this hoping that you recognize the other person’s name or Gravatar and approve their comment.

The easiest way to prevent imposters from commenting on WordPress is to install and activate the Impostercide plugin. For more details, see our step-by-step guide on how to install a WordPress plugin.

Once the plugin has been installed, it will prevent all unauthenticated users from leaving a comment with a registered user’s email address or username. Instead, they will be shown an error message.

You can customize the error message by visiting the Tools » Impostericide page.

7. Remove Website URL Field From Comment Form

The website URL field in the comment form attracts those who wish to use backlinks to boost their search engine rankings on specific keywords. Their goal in leaving a comment is just to get the backlink, not to add any real value to the discussion.

This means their comments usually contain a line or two of irrelevant nonsense, and the comment author’s name will contain a keyword or a combination of a real name with keywords such as ‘Sally from Dunder Mifflin’ or ‘John @SEOconsultants’.

When you remove the website URL field from your comment form, then commenters will not get the value of a backlink, and this should result in less comment spam. Real users will leave a comment on your articles whether they get a backlink or not.

To learn how to do this, see our guide on how to remove the website URL field from the WordPress comment form.

8. Disable Comments on Media Attachments

WordPress automatically creates an attachment page for each image and media file you upload to your website. Users can leave comments on these pages.

This can be useful if images are a central part of your content. If not, it’s just another opportunity for spammers. If you don’t need users to comment on images, then you should turn off comments on media attachments.

The easiest way to do this is by installing and activating the Disable Comments plugin. For more details, see our step-by-step guide on how to install a WordPress plugin.

Upon activation, you need to go to the Settings » Disable Comments page and check the box next to the ‘Media’ option.

Make sure you click on the ‘Save Changes’ button to store your settings. The plugin will now disable comments on your WordPress media files and attachments.

9. Disable HTML in Comments

By default, WordPress allows certain HTML tags within the comments, and these can be used to hide spam links. You can discourage this by disabling HTML in comments.

That means that any HTML tags that are used in a comment will be seen as text, but will not be functional. For example, if someone uses the <strong> tag, then the tag will be seen in the comment and the text will not be bolded. It also means that links won’t be clickable.

To disable HTML comments you will need to add a text snippet to your theme files. If you need help adding code to your site, then refer to our beginner’s guide on how to paste snippets from the web into WordPress.

You need to add the following code to your theme’s functions.php file or use WPCode (recommended):

Here’s our guide on how to add code snippets via the free WPCode plugin because it’s the easiest method available.

This code changes HTML code into HTML entities that are displayed in the comment and not parsed by the browser.

10. Set a Minimum and Maximum Comment Length

We once ran into a comment spam problem where a spammer was leaving hundreds of comments per hour with a single word: ‘hello’.

Akismet and Sucuri were not able to block this because the comment looked natural. Antispam Bee slowed the spammer down but wasn’t able to entirely block the attack.

We were able to combat the spam by using the Yoast Comment Hacks plugin that lets you set a minimum and maximum comment length.

We simply enabled the Yoast Comment Hacks plugin and set the minimum comment length. After that, they received an error message when trying to leave a comment of just one word.

11. Disable Trackbacks in WordPress

As we said earlier, one main reason that people leave comment spam is to get trackbacks. However, for most blogs, it is not necessary to have trackbacks enabled.

You can choose to disable trackbacks on your entire blog or in an individual post. This is an easy way to significantly reduce comment spam.

Simply navigate to the Settings » Discussion page. Here you can uncheck ‘Allow link notifications from other blogs (wingbacks and trackbacks) on new articles’.

This will turn off trackbacks for all new posts. You should now follow our guide on how to disable trackbacks on existing posts.

12. Turn Off Comments on Old Posts

WordPress allows you to turn off comments on old posts. This is particularly helpful for websites publishing content that is timely, such as news or events websites.

Simply go to Settings » Discussion, and under ‘Other comment settings’ you will see the option ‘Automatically close comments on articles older than XX days’. Check the box next to this option and enter the number of days you want comments to be displayed on a post.

WordPress will now automatically close comments on posts older than the number of days you defined for this option.

If you need, you can override the comment deadline in WordPress for individual posts where you would like comments to remain open.

BONUS – 13. Switch Off Comments

Perhaps you have no need for comments on your WordPress site, or you find that comment moderation is taking too much time. You can always switch off comments in WordPress and avoid comment spam entirely.

To disable comments on new posts, you will have to go to Settings » Discussion and uncheck the box next to ‘Allow people to post comments on new articles’.

You will also have to switch off comments on all existing posts. To learn several ways to do that, check out our guide on how to completely disable comments in WordPress.

Frequently Asked Questions About Spam Comments

Why are they spamming me?

Don’t take it personally. Spammers want to get better search rankings or lure unsuspecting visitors to dubious and malicious sites. They think that by spamming they can get more links, and it will somehow positively affect their search rankings.

In most cases, it is not a personal attack against you. Rather, it’s a systematic process that targets many blogs.

What happens to comments that are marked as spam?

When you moderate comments, those you mark as spam will not be displayed on your website. Instead, they are moved to the spam list on your Comments page.

If you move a comment there in error, then you can recover it by clicking the ‘Not Spam’ link under that comment. There is also a link so you can delete a spam comment permanently.

Why is every comment going into the moderation queue?

When you follow the first tip in this article and turn on comment moderation, then you will need to approve every comment that is left on your website. This gives you absolute control over any comment that gets published on your website.

We hope this tutorial helped you learn how to stop comment spam in WordPress. You may also want to learn how to speed up your WordPress performance or check out our ultimate WordPress security guide.

If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.