Update, September 2026: the steps below still match WordPress, but three details have moved. The plugin is now listed as Akismet Anti-spam: Spam Protection. Its free key is for personal, non-commercial sites only, so a blog carrying ads needs a paid plan. And the word list has been renamed from blacklist to blocklist and has grown from 42,000 phrases to more than 65,000.
Today I’m gonna quickly show you how to drastically reduce spam comments. You will only need a few free plugins and a list.
The list:
- Settings in ‘vanilla’ WordPress
- The plugins that will save your life!
Settings in ‘vanilla’ WordPress to stop spam
For these options, hover on the Settings bar on the left and click then on Discussion
Let’s start with a few options you can toggle and combat spam without any plugin. In my opinion, the chapter ‘Disallowed Comment Keys’ is the most important! :
Default post settings
Here you have three options. The option ‘Allow people to submit comments on new posts’ gives already a lot of control: Toggle it off and on every blog you post, there won’t be an option to write comments.
Other comment settings
Here you have already more variety. These are the settings which can influence the comments:
- Comment author must fill out name and email
- Easy. You have to type in your name and your email. It is a small barrier which most of the bots know, but still, a hurdle.
- Users must be registered and logged in to comment
- If your website/blog has an option where people can register, then this is a great option. Defeats a lot of spam, since only registered members can comment.
- Automatically close comments on posts older than X days
- Doesn’t really stop spam, but I find it useful since it keeps the comment section under control.
Email me whenever
This chapter is rather for control. You can get an email if Anyone posts a comment or A comment is held for moderation (more on it later). The first option is great since it provides maximum security, but it can be really painful on bigger sites with a lot of comments. In my opinion, enable the second option and only the first one if you don’t have a lot of users commenting.
Before a comment appears
The following two options are very helpful: Comment must be manually approved and Comment author must have a previously approved comment. The first one gives you again full control: no comment gets posted until you have reviewed it. Very helpful, but can again be a lot of work if you have a lot of interaction.
The second is personally a must. You review a certain individual, approve his comment only once and then that’s it.
Comment Moderation
“Hold a comment in the queue if it contains X or more links. (A common characteristic of comment spam is a large number of hyperlinks.)”
Simple option. If a comment contains X links, it doesn’t get published, but held back. My spam comments always contain one or two links, so set a low number and remove a lot of comments.
“When a comment contains any of these words in its content, author name, URL, email, IP address, or browser’s user agent string, it will be held in the moderation queue. One word or IP address per line. It will match inside words, so “press” will match “WordPress””
Here you can add certain keywords which then cause a comment to be held back. I don’t use this one, but maybe you have certain words that need to be filtered. I prefer the next and last option:
Disallowed Comment Keys – the best spam remover
“When a comment contains any of these words in its content, author name, URL, email, IP address, or browser’s user agent string, it will be put in the Trash. One word or IP address per line. It will match inside words, so “press” will match “WordPress”.”
This is one of the best methods to reduce spam! You input certain words which then cause a comment to be put in the trash.
Don’t worry, I got you: Here is a list with more than “65,000 phrases, patterns, and keywords commonly used by spammers and comment bots in usernames, email addresses, link text, and URIs. “
Here’s the link: Comment Blocklist for WordPress
How to add the ‘Comment Blocklist for WordPress’:
- There is a plugin, but you can also do it manually:
- Click on Blacklist.txt
- Then there you have the list.
- Click on RAW
- A new window opens with only the words
- Do Ctrl+A, then Ctrl+C
- Paste the words into Disallowed Comment Keys. It might block a few seconds…it’s still 65k words!
- Go to the bottom and click Save changes
- There you go, that’s it! Enjoy a lot less spam.
Plugins that reduce or stop spam comments
Akismet Anti-Spam
This plugin helps you to filter even more spam. It’s only free for personal, non-commercial sites and the comments are directly checked.
Wordfence
Alright, it’s not really doing anything for spam comments, but it takes care of hacking, brute force attacks etc. So again against bots, but the harmful ones. I explain this plugin in another blog post much more detailed, but I still felt the need to mention it here.
Well that’s it for today, I wish you a spam-free day and see you soon
Read next: Set up the Wordfence firewall · Remove a website from Google · All blog posts