WPMEW
BACK TO BLOG
wordpress
September 17, 2026

How to Stop Spam in WordPress: Comments, Forms & Registrations (2026)

By wpmew

The best WordPress spam protection uses layers: tighten the built-in discussion settings, add an antispam filter such as Akismet or Antispam Bee, protect forms with an invisible challenge such as Cloudflare Turnstile, and block fake registrations. No single plugin catches everything, but these layers together stop almost all automated spam.

Short answer: Install Antispam Bee (or Akismet) for comments, add Cloudflare Turnstile to your comment, login, registration, and contact forms, and turn off comments on old posts.

Key takeaways

  • Most WordPress spam comes from bots, and bots are easy to stop with honeypots and invisible challenges.
  • Turn off features you don’t use. If you don’t need comments, trackbacks, or open registration, disable them.
  • Prefer invisible CAPTCHAs (Turnstile, honeypots) over puzzles that annoy real visitors.
  • Spam affects deliverability. Contact form spam sent through your domain can hurt your email reputation.

[IMAGE: Layered diagram with WordPress settings → antispam filter → Turnstile challenge → firewall, blocking spam bots. Suggested alt: “Layers of WordPress spam protection”. Suggested filename: wordpress-spam-protection-layers.webp.]

Step 1: Fix WordPress discussion settings

Go to Settings → Discussion. These built-in settings stop a lot of spam without any plugin.

  • Uncheck “Allow link notifications from other blogs (pingbacks and trackbacks).” Almost all trackbacks are spam.
  • Check “Comment author must fill out name and email.”
  • Check “Automatically close comments on posts older than 30 days” (or 60 or 90). Bots target old, well-ranked posts.
  • Set “Hold a comment in the queue if it contains 2 or more links.” Spam comments usually include links.
  • Check “Comment must be manually approved” on small sites where you want full control.
  • Add common spam words to Disallowed Comment Keys, one per line. Matching comments go straight to trash.

Don’t need comments at all? Uncheck Allow people to submit comments on new posts, then bulk-edit existing posts and set Comments → Do not allow.

Step 2: Add an antispam plugin for comments

Akismet

Akismet checks every comment against a global spam database run by Automattic. It’s very accurate and shows a spam history for each commenter.

  • Pros: Very accurate, works with many form plugins and WooCommerce reviews.
  • Cons: Needs an API key. Commercial sites need a paid plan. Comment data is sent to Automattic’s servers, which you should mention in your privacy policy.

Antispam Bee

Antispam Bee is completely free, including for business sites, and doesn’t send data to an outside service.

  • Pros: Free, privacy-friendly, no account needed, can block comments by country or language.
  • Cons: Only protects comments and trackbacks, not contact forms.

Choose one. Running both usually doesn’t catch more spam and makes it harder to debug false positives.

Step 3: Protect forms with Cloudflare Turnstile

Cloudflare Turnstile is a free, privacy-friendly alternative to Google reCAPTCHA. Most visitors never see a puzzle, because it checks browser signals in the background.

  1. Sign in to Cloudflare (a free account works, and your site doesn’t need to use Cloudflare DNS).
  2. Go to Turnstile → Add widget, enter your domain, and choose Managed mode.
  3. Copy the Site key and Secret key.
  4. Install Simple Cloudflare Turnstile and paste in the keys.
  5. Turn it on for login, registration, lost password, and comments, plus your form plugin and WooCommerce checkout if you use them.
  6. Log out and test each form.

Prefer reCAPTCHA? reCAPTCHA v3 is also invisible, but it shares data with Google and may need cookie consent in the EU.

Step 4: Stop contact form spam

Most form plugins have their own spam tools. Turn them all on:

  • WPForms: Turn on the built-in antispam token and Akismet integration, and add Turnstile under Settings → CAPTCHA. Country and keyword filters are available on paid plans.
  • Contact Form 7: Use its Turnstile or reCAPTCHA integration, Akismet support, and a honeypot add-on.
  • Gravity Forms / Fluent Forms / Formidable: Turn on the honeypot and add Turnstile or reCAPTCHA.

Extra tips:

  • Add a honeypot field. It’s hidden from people but bots fill it in.
  • Don’t publish your email address as plain text. Use a form instead.
  • Block form submissions with links if your visitors never need to send URLs.
  • Send form emails through WP Mail SMTP so spam doesn’t hurt your domain’s email reputation.

Step 5: Stop fake user registrations

Spam bots create thousands of fake “subscriber” accounts.

  1. Don’t need registration? Go to Settings → General and uncheck Anyone can register.
  2. Need registration? Add Turnstile to the registration form. Require email confirmation. Consider manual approval with a plugin such as New User Approve.
  3. Change the default role to Subscriber. Never set it to Author or Administrator.
  4. Clean up existing fake accounts under Users. Sort by registration date and look for accounts with no posts, orders, or comments. Back up before deleting in bulk.

Step 6: Stop WooCommerce spam

  • Fake orders and card testing: Add Turnstile or reCAPTCHA to checkout. Use your payment gateway’s fraud tools, such as Stripe Radar. Rate-limit checkout requests.
  • Fake account sign-ups: Protect My Account registration with Turnstile.
  • Spam product reviews: Under WooCommerce → Settings → Products, allow reviews only from verified owners.

Step 7: Block spam bots before they reach WordPress

Blocking bad traffic at the server or network level saves server resources.

  • Use Cloudflare’s free plan with Bot Fight Mode and a WAF rule that challenges requests to wp-login.php, xmlrpc.php, and wp-comments-post.php from suspicious sources.
  • Disable XML-RPC if you don’t use the WordPress mobile app or Jetpack. Many security plugins have a setting for this.
  • Use a security plugin such as Wordfence to rate-limit logins and block IP addresses that attack your site repeatedly.

How to clean up existing spam

  • Comments: Go to Comments → Spam → Empty Spam. For huge backlogs, filter by Pending and bulk-mark as spam.
  • Database: Run WP-Optimize to delete spam and trashed comments and their comment meta.
  • WP-CLI (fastest for large sites): wp comment delete $(wp comment list --status=spam --format=ids) --force

Always back up before deleting in bulk. See our list of common WordPress errors if something goes wrong.

Site typeSetup
Personal blogDiscussion settings + Antispam Bee + Turnstile on comments
Business site (no comments)Comments off + Turnstile on contact form + WP Mail SMTP
Membership / communityAkismet + Turnstile on registration + email confirmation
WooCommerce storeTurnstile on checkout and account + verified-owner reviews + Stripe Radar

FAQs

Is Akismet free?

Akismet is free for personal, non-commercial sites. Business and commercial sites need a paid plan. Antispam Bee is a free alternative for any kind of site.

Does a CAPTCHA hurt conversions?

Visible puzzle CAPTCHAs can reduce form submissions. Invisible options such as Cloudflare Turnstile and honeypot fields protect forms with little or no effect on real visitors.

Why am I still getting spam after installing a plugin?

Some spam is sent by real people, which bots-focused tools can’t detect. Hold comments with links for moderation, add disallowed keywords, and close comments on old posts. Also check that your caching plugin isn’t serving an old copy of the form without its antispam token.

Does spam affect SEO?

Yes. Published spam comments add low-quality outbound links to your pages, and thousands of spam entries bloat your database and slow the site down. Keep spam out of published content.