How Do I Reduce WordPress Comment Spam?
How Modern Anti-Spam Filtering Works
Rather than relying on simple keyword blocklists (easily evaded), modern anti-spam plugins check submitted comments against a large, shared database of known spam patterns and sender reputation signals, continuously updated as new spam techniques emerge across millions of sites using the same service. This catches the large majority of spam automatically, with false positives (genuine comments incorrectly flagged) generally rare enough to be worth the tradeoff.
Additional Measures Worth Layering In
- Comment moderation for first-time commenters (a built-in WordPress setting) holds a new commenter's first comment for manual approval, then allows subsequent comments through automatically once approved — a reasonable middle ground between full moderation and none.
- A honeypot field (invisible to real users, but often filled in by automated spam bots) is a lightweight additional filter some plugins include, catching a portion of spam that might otherwise slip through pattern matching.
- Closing comments on very old posts automatically, since spam bots frequently target older, less-monitored content specifically.
- Requiring an email address (already a WordPress default) is a very basic filter but adds negligible friction for genuine commenters while discouraging the most low-effort automated spam.
Setting This Up
- Install and activate a reputable anti-spam plugin as the primary defense.
- Enable moderation for first-time commenters as a lightweight additional check.
- Consider auto-closing comments on older posts if spam frequently targets aging content.
Dealing with a spam problem an existing setup isn't catching? See WordPress bug fix.