Stopping WordPress Comment Spam

Layer one is Akismet screening every incoming comment against its cloud intelligence, backed by strict settings under Settings → Discussion that convert spam from publishable to moderated. Akismet auto-trashes obvious spam and holds questionable comments; personal blogs select the name-your-price tier, commercial sites need a paid plan (verify current terms at akismet.com).

• First-time approval: enable "Comment author must have a previously approved comment" — new commenters wait for a human, regulars publish instantly.
• Manual approval: "Comment must be manually approved" for full control, or skip it once layer two holds.
• Link threshold: set Comment Moderation to hold comments containing one link — genuine comments rarely carry any, spam almost always carries at least one.
• Legacy channels: turn off trackbacks and pingbacks; most sites gain nothing from them.
• Auto-close: close comments on posts older than 30 or 60 days, when most genuine discussion has ended.

Together these change spam's economics: the bot's submission still costs it nothing, but nothing publishes without passing you.

An inherited pile needs bulk removal, not one-by-one trashing: clear flagged spam in one click, filter the pending queue by author, IP or date, and use WP-CLI for the largest cleanups.

1. Flagged spam: Comments → Spam, then the Empty Spam button deletes everything flagged in one click.
2. Pending queue: filter by author, IP address or date range and clear each batch with bulk actions.
3. WP-CLI (hosts with SSH): remove every awaiting-moderation comment in one pass — after a database backup:

   wp comment delete $(wp comment list --status=hold --format=ids)

4. Empty the trash so the rows actually leave the database.

Finish by confirming the layers above are switched on — otherwise the pile rebuilds within days. The keyword field under Settings → Discussion helps it stay down: paste spam phrases, suspicious domains and bad IPs into Disallowed Comment Keys, one per line; community-maintained lists on GitHub are a better starting point than assembling your own, and you prune what over-triggers.

Published spam hurts: pages bristling with pharmaceutical links read as neglect to crawlers, and Google's guidance for years has been to moderate or disable unmanaged comment sections. Held-but-unpublished spam does not directly harm rankings — search engines never see it — but the bloat tax is real: database size, backup weight, query overhead.

The link economy deserves honesty on both sides. Comment links have carried rel="nofollow" in WordPress since the 2005 nofollow initiative, and since WordPress 5.3 (November 2019) comment links carry rel="nofollow ugc" — the ugc value telling search engines the content is user-generated. So the ranking value spammers chase is largely worthless; the harm is to your site's appearance and performance, not a gain to them. Bottom line: moderate what publishes, keep the library lean, disable comments where they serve nothing — and put the recovered attention into content.

If spam has become a security problem rather than a moderation one, WebJi®'s WordPress security services handle cleanup, and the 24-point WordPress security checklist continues from there; the recovery path after a real compromise is the hacked-site fix guide.