Comment spam is one of those problems that never fully goes away, it just changes shape. Bots get smarter, spammers rotate through link farms, and every so often a plugin update quietly breaks whatever filter you had working. The good news is that the tools for fighting it have not really changed: honeypots, sane moderation rules, and challenge screens used sparingly. The trick is picking the right layer for the job instead of throwing a CAPTCHA at every visitor and calling it done.
Why comment spam keeps coming back
Most comment spam is not personal. It is automated, cheap to send, and aimed at building backlinks or testing which forms accept submissions. A script fills in a name, a fake email, a link, and a few lines of generic praise, then moves on to the next site on its list. Because the cost of sending is near zero, even a low success rate is worth it to whoever is running the campaign.
That matters for how you defend against it. You are not trying to stop a determined human who is targeting your site specifically. You are trying to filter out automated noise without adding friction for the real reader who wants to leave a thoughtful reply. Those are different problems, and they call for different tools.
Honeypots: the quiet workhorse
A honeypot is a form field that is invisible to human visitors but visible to bots that read the raw HTML. Real people never fill it in because they never see it. Bots that blindly complete every field on a form fill it in every time, which flags the submission as spam without ever showing a challenge to your actual readers.
Honeypots are low friction and effective against the least sophisticated bots, which make up a large share of comment spam traffic. They are not perfect. More capable bots render pages and can spot hidden fields, so a honeypot alone will not stop everything. But as a first filter that costs your readers nothing, it is hard to beat. Many comment spam plugins include a honeypot field by default, and it is worth confirming yours does before layering on anything heavier.
Moderation rules that do not punish real readers
Beyond honeypots, WordPress’s built-in discussion settings do a lot of the heavy lifting if you actually tune them. A few worth checking:
- Require comments to be manually approved on a first post from a new commenter, then allow their later comments through automatically.
- Hold comments with more than a certain number of links for moderation. Spam almost always includes links, genuine replies rarely do.
- Maintain a moderation blocklist of words, phrases, and IP ranges that show up repeatedly in spam you have already caught. This list gets more useful the longer you run it.
- Require name and a valid-looking email format, which filters out the sloppiest automated submissions without asking anything unreasonable of a real visitor.
If you are comfortable with the command line, wp-cli makes cleanup fast. To see how much spam is sitting in your queue:
wp comment list --status=spam --format=countAnd to clear it out in bulk once you have confirmed it is genuinely spam:
wp comment delete $(wp comment list --status=spam --field=ID) --forceRunning that occasionally, or on a schedule, keeps your database lean and your moderation queue from becoming something you dread opening.
Challenge screens: use sparingly
CAPTCHAs and similar challenge screens work, but they come with a real cost. Every additional step between a reader finishing their comment and it actually posting is a chance for them to give up, especially on mobile. Visual puzzles and checkbox challenges also tend to load extra scripts, which can nudge your INP in the wrong direction if you are aiming for the 200 millisecond threshold that matters for Core Web Vitals.
The practical middle ground is to reserve challenges for situations where you have evidence they are needed, rather than applying them site wide. If a specific post is getting hit hard, or if honeypots and moderation rules are not keeping up, a lightweight challenge on that comment form is a reasonable trade. Making every visitor on every page prove they are human before they can say anything is usually overkill, and it reads to your audience as a sign the site does not trust them.
Let the edge do some of the work
If your site sits behind Cloudflare, you already have a layer of defense working before requests even reach your server. Cloudflare’s bot mitigation and WAF rules catch a meaningful share of automated traffic, including some comment spam bots, without you configuring anything specific to WordPress. Keeping your origin IP unpublished also reduces the chance that spam and attack traffic finds a way to bypass the edge entirely and hit your server directly. None of this replaces WordPress level moderation, but it thins the herd before it arrives, which means your honeypots and blocklists have less to filter.
A managed WordPress host that runs Cloudflare in front of every site, as ServerBorn does, saves you from having to configure this edge layer yourself. That is one less thing to maintain, though the WordPress side moderation rules above still matter regardless of who is running your edge.
When to just close old threads
Not every comment section needs to stay open forever. Spammers disproportionately target old posts, partly because those posts often have less active moderation and partly because the spammer is not trying to reach your current readers at all, just to plant a link that search engines might crawl. If a post is a year old and the conversation has run its course, closing comments removes the target entirely.
WordPress has a built-in setting for this under Settings, Discussion: automatically close comments on posts older than a number of days you choose. You can also set it directly with wp-cli:
wp option update close_comments_for_old_posts 1
wp option update close_comments_days_old 60Adjust the day count to fit how your site actually gets used. A news style blog might close comments after a couple of weeks. A reference or how-to site where people ask questions for years might set the window much longer, or exclude certain post types from the rule entirely. The point is not to shut down conversation, it is to stop leaving old, unwatched threads open as an easy target.
The takeaway
No single tool eliminates comment spam, but layering a few costs almost nothing for real readers. A honeypot catches the sloppy bots for free. Tuned moderation rules and a growing blocklist catch the rest without adding friction. Save challenge screens for posts that actually need them, let your edge network filter what it can before it reaches WordPress, and close comments on old posts once the conversation has settled. That combination keeps your comment sections useful for people while staying mostly invisible to the bots.