Stop WordPress comment spam with Akismet and reCAPTCHA

Bots can post thousands of comments with links, automated text or fraudulent content even if you do not use a contact form. WordPress lets you stop them by combining moderation, Akismet and, if the volume calls for it, a reCAPTCHA challenge.

Adjust comment moderation

In Settings > Discussion:

• You can require a name and email, but that does not verify that the author controls that address.
• Hold comments for moderation when they contain links.
• Require approval for new authors.
• Automatically close comments on old posts if you no longer need the conversation.
• Disable pingbacks and trackbacks if they create noise.

If the website does not use comments, disable them globally and check older posts, because changing the default setting does not always close comments that are already open.

Set up Akismet

Akismet analyses each comment and separates spam without making every visitor solve a challenge. Install or activate the plugin, connect a key suited to the type of project and check the Spam folder regularly for false positives.

Only mark as legitimate the comments you have reviewed; that information helps correct the classification. Empty the spam after checking it to reduce the size of the database.

Add reCAPTCHA

If Akismet and moderation are not enough, install a reCAPTCHA plugin compatible with your comment form and WordPress version. Create keys for the exact domain and enable protection only on the forms that need it.

Test it in a private window before considering it done. An incorrect configuration can stop legitimate visitors from commenting or block AJAX calls used by the theme.

If the spam continues

1. Update WordPress, the theme and plugins.
2. Check whether the messages arrive through comments, the contact form, user registration or WooCommerce reviews.
3. Check the URLs being targeted and disable any form you do not use.
4. Block patterns or countries only when the evidence is clear; a broad list can exclude legitimate users and search engines.

Contact form spam has a different source. For that case, see Mass spam from application forms.

Check before considering it solved

Post a legitimate comment from a logged-out session and check whether it is held, published or sent to Spam as you expected. Also check old posts and reviews if you use them: their settings may be independent.

With reCAPTCHA, test that the server rejects a request without valid verification before saving the comment. The secret key must not appear in the HTML. Check the terms of the Akismet plan for your type of project and do not assume commercial use is free.

Keep the previous configuration and review false positives before tightening the filter. Blocking entire countries does not replace identifying the form that is receiving the abuse.