Comment spam: what it is and how to stop it

What is comment spam?

Comment spam is any comment posted to promote something rather than join the conversation. Most of it exists to get a link onto your page, either in the comment text or in the author's website field, and much of it comes from bots.

Nobody publishes a reliable figure for the share of blog comments that are spam. The volume is clearly huge, though: Akismet's homepage counter showed more than 573 billion blocked pieces of spam in October 2026.

Why do spammers target your site?

It started as a search engine game. On January 18, 2005, Google introduced rel="nofollow" to fight comment spam, citing "linked blog comments like 'Visit my discount pharmaceuticals site.'" Links with the attribute, Google said, "won't get any credit when we rank websites in our search results."

On September 10, 2019, Google added rel="ugc", recommended "for links within user generated content, such as comments and forum posts," along with rel="sponsored". All three became hints rather than strict rules, but Google said it would generally not consider these links for ranking. Since WordPress 5.3 in 2019, comment links and comment author URLs get rel="nofollow ugc" automatically.

So why does spam keep coming? Posting by bot costs almost nothing, so spammers hit every open comment form whether or not the links count. In the 2026 Bad Bot Report from Imperva and Thales, based on 2025 data from their own network, bots made up 53% of all web traffic, up from 51% a year earlier, and bad bots alone accounted for 40%.

What comment spam looks like

Some spam is written to slip past a quick look. Watch for:

• Generic praise with a link, like "Great post, very informative!" plus a URL in the website field.
• An author name that's a keyword or business name instead of a person's name.
• Links to pharmacy, casino, crypto, loan or adult pages.
• Text copied from your post or from other comments, sometimes slightly reworded.
• Text in a language unrelated to the post.
• Trackback and pingback spam mixed in with real replies.

7 layers that stop comment spam

No single setting catches everything without blocking a real reader now and then. Stack a few cheap checks so bots drop out early. Prices are as of October 2026.

Or skip the plugin stack

CommentCamp is a free comment system we're building for independent publishers, bloggers and WordPress sites. Automated spam filtering and a moderation queue are built in, so you don't need a third-party anti-spam plugin. It will launch with an official WordPress plugin and a universal embed for any other site. It's $0 for site owners and funded by an optional member Pro upgrade for readers, not ads. It's in private early access: join the waitlist and we'll email your invite as rollout expands.

Start with WordPress's built-in defenses

WordPress runs 3 of the 7 layers out of the box:

• Under Settings > Discussion, it holds any comment with 2 or more links, because "a common characteristic of comment spam is a large number of hyperlinks."
• "Comment author must have a previously approved comment" is on, so first-time commenters wait for your approval.
• Core code rejects a new comment that arrives within 15 seconds of the last one from the same IP address or email, with the message "You are posting comments too quickly. Slow down."

The Discussion screen also has two keyword boxes. Comment Moderation keys hold matching comments in the queue, and Disallowed Comment Keys send matches straight to the Trash. Add the spam domains, email addresses and IPs you keep seeing. Our comment moderation guide covers queue workflows in more depth.

Note: Both keyword boxes match inside words, so adding "press" also catches "WordPress".

Add a honeypot, a filter or a challenge

A honeypot is the cheapest add-on. WP Armour is free, has 400,000+ active installs and uses JavaScript to insert a hidden field that bots fill in and people never see, with "No tracking, cookie storage or external server calls."

For a full filter, the three common WordPress choices are:

• Akismet (Automattic, launched October 2005, 5,000,000+ active installs) checks comments against a cloud spam database. Personal is pay what you can for non-commercial sites, and Akismet says the average person pays $36.00 a year. Pro is $9.95 a month billed yearly for 500 spam checks a month on 1 site; see our Akismet pricing guide.
• Antispam Bee (700,000+ active installs) is free and works "without captchas and without sending personal information to third party services," though its optional country and language checks call outside services.
• CleanTalk (200,000+ active installs) is a cloud service with no CAPTCHA: a 7-day free trial, then $12 a year for 1 website.

If bots still hammer your form, add a challenge:

• Cloudflare Turnstile: a free plan with unlimited challenges, up to 20 widgets per account and 10 hostnames per widget, and no other Cloudflare services required.
• Google reCAPTCHA: free up to 10,000 assessments a month per organization. The Premium tier charges an $8 flat fee for 10,001 to 100,000 assessments, then $1 per 1,000.
• hCaptcha: Basic is $0. Pro is $99 a month billed yearly or $139 month to month, with 100,000 evaluations a month included.

Our WordPress anti-spam plugins comparison puts these side by side.

When spam still gets through

Mark missed comments as spam instead of just deleting them, and add repeat domains or phrases to Disallowed Comment Keys.

If old posts attract most of the junk, check "Automatically close comments on old posts" in Settings > Discussion. It's off by default, with 14 days pre-filled. If fake pingbacks pile up, uncheck "Allow link notifications from other blogs (pingbacks and trackbacks) on new posts" on the same screen.