Spam remains one of the most persistent annoyances for WordPress site owners, whether it shows up in comment sections, contact forms, or user registrations. A new step-by-step guide from WPBeginner, drawn from over 16 years of running anti-spam tests on its own sites, lays out how to tackle the problem starting with free, built-in WordPress settings before moving into more advanced protections.
Start With the Discussion Settings
WordPress ships with anti-spam controls that most site owners never fully configure. Under Settings, Discussion, the comment moderation queue is the first line of defense. Turning on “Comment must be manually approved” keeps every submission hidden from public view until a site owner reviews it, so nothing spammy ever reaches visitors even if it slips past other filters.
The guide also recommends lowering the link threshold in the Comment Moderation box. WordPress defaults to holding a comment for review once it contains two or more links, since spam almost always includes web addresses. Dropping that number to one link catches more junk automatically. The Disallowed Comment Keys field lets site owners paste specific trigger words, names, or email addresses that should send matching comments straight to the trash.
Require Real Information From Commenters
Requiring a name and email address for comments, found under Other Comment Settings, discourages anonymous drive-by spam while still being an easy ask for genuine visitors. Combined with holding first-time commenters for approval, this creates a simple filter that separates real engagement from bot traffic.
Disabling Comments Entirely
For sites that do not rely on a comment section, such as many business or brochure sites, the guide points out that disabling comments altogether removes the problem completely. It recommends doing this through a free code snippets plugin rather than editing theme files directly, since a snippet survives theme updates while manual edits can be overwritten. The example snippet removes comment support across all post types, closes comments and pings on the front end, and strips the comments menu and dashboard widget from the admin area.
More Layers to Come
WPBeginner’s guide continues beyond these basics into AI-powered spam bot protection, contact form and user registration hardening, site-wide firewalls, and ongoing spam cleanup and monitoring, framing spam protection as a layered strategy rather than a single setting.
For WordPress site owners and hosting professionals managing client sites, the built-in settings covered here cost nothing and take only minutes to configure, making them a sensible first step before investing in dedicated anti-spam plugins.