Best WordPress anti-spam plugins compared

How WordPress anti-spam plugins work

Anti-spam plugins fight comment spam in four ways:

• Cloud filters send each submission to an outside service that compares it with a shared spam database.
• Local rule plugins check timing, links and your own spam history on your server.
• Honeypots add a hidden field that bots fill in and people never see.
• Challenges run a browser check, like Cloudflare Turnstile or hCaptcha, before a form goes through.

Cloud filters see spam from many sites but send visitor data to a third party. Local rules and honeypots keep data on your server. Prices are as of October 2026.

The 8 best WordPress anti-spam plugins

CommentCamp

CommentCamp is a free comment system for publishers and WordPress sites, launching with an official WordPress plugin and a universal embed script. Spam filtering and a moderation queue are built in, so comments need no separate anti-spam plugin; for contact forms, add a honeypot like WP Armour.

• Price: $0 for site owners, free forever, no ads
• Active installs: private early access, onboarding the first cohorts of sites (join the waitlist)
• Best for: stopping comment spam with no filter to configure or pay for

Disclosure: CommentCamp is our product.

Akismet

Akismet, from Automattic, checks comments and contact form submissions against a global cloud spam database. It needs an API key, and the plugin page says "Keys are free for personal blogs; paid subscriptions are available for businesses and commercial sites."

• Price: Personal is name your price for non-commercial sites; Pro $9.95/month billed yearly (500 checks a month, 1 site); Business $49.95/month billed yearly (5,000 checks, unlimited sites)
• Active installs: 5,000,000+
• Best for: personal blogs, or businesses happy to pay for a cloud filter

Antispam Bee

Antispam Bee, from pluginkollektiv, is free, ad-free and runs without CAPTCHAs. It filters locally: it trusts approved commenters, checks comment timing, matches IPs, URLs and emails against spam already in your own database and treats BBCode links as spam.

• Price: Free
• Active installs: 700,000+
• Best for: any site, commercial ones included, that wants a free local filter

CleanTalk

Anti-Spam by CleanTalk is a cloud service with no CAPTCHA and no limit on checks. Its Spam FireWall blocks known spam bot IPs, nearly 5.8 million according to the plugin page, before your pages load.

• Price: 7-day free trial, then $12/year for 1 site, $24 for 3 or $69 for 10; unlimited sites $27/month
• Active installs: 200,000+
• Best for: commercial sites that want a cloud filter at a flat yearly price

WP Armour

WP Armour is a honeypot: JavaScript inserts a hidden field with a unique name for each site, which bots fill in and people never see. The plugin page promises "No tracking, cookie storage or external server calls," and it's rated 100 out of 100 from 1,470 ratings.

• Price: Free; Extended version from $19.99/year
• Active installs: 400,000+
• Best for: an invisible first layer that sends no data anywhere

Simple CAPTCHA with Cloudflare Turnstile

This free plugin by RelyWP adds Cloudflare Turnstile to your forms using a site key and secret key from a Cloudflare account. No other Cloudflare service is required, and an optional failsafe mode lets submissions through, or falls back to reCAPTCHA, if Cloudflare is down.

• Price: Free; Turnstile's free plan has unlimited challenges, up to 20 widgets per account and 10 hostnames per widget
• Active installs: 200,000+
• Best for: a free challenge with no per-check fees

hCaptcha for WP

hCaptcha for WP works with 60+ integrations, including Contact Form 7, WooCommerce and Elementor. Before the challenge, it adds a honeypot field and a minimum submit time.

• Price: Free plugin; hCaptcha Basic is $0, Pro is $99/month billed yearly ($139 month to month)
• Active installs: 70,000+
• Best for: sites with many forms, like WooCommerce stores

OOPSpam

OOPSpam Anti-Spam checks submissions through a cloud API with "No logs by default," and every plan covers unlimited websites.

• Price: 40 free checks/month; paid plans from $23/month for 25,000 checks
• Active installs: 6,000+
• Best for: agencies running many sites

Price, installs and data compared

Akismet vs Antispam Bee

Akismet compares each comment with its global spam database. Antispam Bee only knows what has already hit your site, plus its local rules, so brand-new spam sources won't be in its database until they trip another rule.

The bigger difference is cost. Akismet's support docs say "Free keys that come with Akismet Personal plans do not support commercial activities," which covers ads, affiliate links, promoting a business, donations and e-commerce. A monetized blog pays at least $9.95 a month, billed yearly. Antispam Bee costs nothing on any site and has no check quota, since it runs on your own server. See our Akismet pricing guide.

CleanTalk vs Akismet

Both are cloud filters. CleanTalk charges $12 a year for 1 site with no limit on checks, while Akismet Pro's $9.95 a month, billed yearly, covers 500 spam checks a month on 1 site. CleanTalk also collects more: on top of IP, email and form content, it records behavioral data such as typing speed and mouse movements.

Privacy and GDPR notes

For zero data leaving your server, use WP Armour, or Antispam Bee with its default settings. Antispam Bee, which calls itself "100% GDPR compliant," only contacts outside services if you switch on optional checks: a country filter sends a shortened IP to iplocate.io, a language check sends the comment text to pluginkollektiv's own API and a Gravatar check asks Gravatar about an email hash.

Cloud filters send personal data by design. Akismet typically receives the commenter's IP address, name, email and comment, among other fields, and Automattic keeps most spam data "between two weeks and ninety days." CleanTalk keeps its data for 7 or 45 days, depending on the plan. Whichever cloud service you use, name it in your privacy policy.

Start with WordPress settings, then stack carefully

Before you add anything, check your WordPress comment settings. By default, WordPress holds comments with 2 or more links, holds first-time commenters until you approve one comment and, since version 5.3, adds rel="nofollow ugc" to comment links.

Tip: With CommentCamp, comment spam is filtered for you; for forms, pair one invisible layer (WP Armour) with one filter (Antispam Bee, Akismet or CleanTalk). Add a challenge only if bots still get through, and add one plugin at a time so you know which one blocked a real reader.