Comment Spam Prevention

Stopping Comment Spam in WordPress

Comment spam is one of the most common annoyances for WordPress site owners. From automated bots to manual spammers, here is how to effectively block spam on your BlitzPress site.

Option 1: Disable Comments Entirely

If your site does not need comments (most business sites, landing pages, portfolios):

# Disable on all future posts
sudo wp option update default_comment_status closed --path=$WP --allow-root

# Close comments on all existing posts
sudo wp post list --format=ids --path=$WP --allow-root | xargs -d " " -I {} sudo wp post update {} --comment_status=closed --path=$WP --allow-root

Or in WordPress admin: Settings > Discussion > Uncheck “Allow people to submit comments on new posts”

Option 2: Akismet Anti-Spam

Akismet is the most popular anti-spam plugin, made by Automattic (WordPress.com). It checks comments against a global spam database:

sudo wp plugin install akismet --activate --path=$WP --allow-root

Get a free API key at akismet.com for personal sites.

Option 3: Honeypot Method

Honeypot plugins add invisible form fields that only bots fill in. If the hidden field has a value, the comment is rejected. No CAPTCHA needed, zero friction for real users:

sudo wp plugin install antispam-bee --activate --path=$WP --allow-root

Antispam Bee is free, GDPR-compliant, and works without an external service.

Close Comments on Old Posts

Most spam targets old posts. Auto-close comments after a set period:

In WordPress admin: Settings > Discussion > “Automatically close comments on posts older than X days”

sudo wp option update close_comments_for_old_posts 1 --path=$WP --allow-root
sudo wp option update close_comments_days_old 60 --path=$WP --allow-root

Disable XML-RPC

XML-RPC is an older API that bots abuse for brute force attacks and spam. If you do not use the WordPress mobile app or remote publishing tools, disable it:

# Add to wp-config.php or a mu-plugin
add_filter( 'xmlrpc_enabled', '__return_false' );

Or block at the OLS level for better performance (requests never hit PHP):

# In vhconf.conf or .htaccess
RewriteRule ^xmlrpc\.php$ - [F,L]

Comment Moderation Settings

As a fallback, configure moderation in Settings > Discussion:

Hold comments with more than 2 links for moderation
Add common spam words to the comment moderation list
Require commenters to have a previously approved comment
Require name and email for comments