Protect Your WordPress Site from Spam

What is spam?

Spam is junk. On a website, it is fake comments, links to bad sites and silly form messages. Most of it is sent by robots, not people. Spam makes your site look bad and can hurt how search engines see it. WordPress is a popular tool for building websites.

Step 1: Change comment settings

1. Log in to your WordPress dashboard.
2. Go to Settings, then Discussion.
3. Tick Comment author must fill out name and email.
4. Tick Comment must be manually approved. Now no comment shows until you say yes.
5. Tick Users must be registered and logged in to comment if you want to be stricter.
6. Find the box named Comment Moderation. Set a low number for links, such as 1 or 2. Comments with many links are held back.
7. In Disallowed Comment Keys, add words that spammers love. Comments with these words go to the trash.
8. Click Save Changes.

Step 2: Turn on Akismet

Akismet is a plugin, which is an add-on for WordPress. It checks every comment and puts spam in a separate folder.

1. Go to Plugins, then Installed Plugins.
2. Find Akismet Anti-spam and click Activate.
3. Click Set up your Akismet account and follow the screens. Check the Akismet site to see which type of account suits you.

Step 3: Add a CAPTCHA

A CAPTCHA is a small test, like ticking "I am not a robot". Robots fail it and people pass. Add one to your comment and contact forms with a plugin. Our guide on adding CAPTCHA to WordPress explains how.

Step 4: Close old posts

1. Go to Settings, then Discussion.
2. Tick Automatically close comments on posts older than and enter a number of days.
3. Click Save Changes.

Step 5: Clean up

Go to Comments. Click Spam and then Empty Spam. This deletes the spam for good, so check that no real comments are there first.

Quick recap

• Use moderation and keep comments for approval.
• Turn on Akismet.
• Add a CAPTCHA to forms.
• Close comments on old posts.
• Empty the spam folder now and then.