Practical guides on websites, online stores, and getting found on Google — written for business owners, not developers.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
Comment spam, form spam and fake registrations all cost you time, leads and security. Here's a business owner's guide to stopping WordPress spam for good.
A comment with a link that doesn't belong, a contact form message that's obviously not from a person, or a new user account with a name no human would type because a script typed it. We see all three constantly, across the client sites we manage and our own projects, and none of it is just an annoyance.
Some of those spam comments link to phishing pages, malware, or gambling sites. Fake accounts and bot submissions pile up in your database, and once there's enough noise sitting in there, spotting a real user, or a genuinely suspicious login, gets harder rather than easier.
Left alone, it becomes an SEO problem too. A site full of spammy user-generated content is exactly the kind of pattern search engines watch for.
None of that has to be normal for your site. This guide walks through protecting your comments, contact forms, and registration pages, and the point where each one stops being a nuisance and starts being something bigger.
Bots now generate more than half the internet's traffic. Imperva's 2026 Bad Bot Report puts it at 53%, up from 51% the year before, and 40 percentage points of that is traffic built specifically to cause harm. A public WordPress site sees a slice of that every single day. It shows up in three places: the comment box, every form, and the registration page.
Each place costs you something different. A flooded comment section is a trust signal search engines read, not just an eyesore. A flooded contact form buries the one lead you wanted under a dozen you didn't. A flooded registration page fills your user list with accounts nobody signed up to have, and a few of those exist to test stolen passwords rather than to comment on your blog post.
None of this is free to ignore. Akismet, the plugin bundled with most WordPress installs, estimates that automated bot attacks cost the average business 3.6% of its annual revenue, and that sorting spam by hand eats roughly 20 hours a month on a site that doesn't automate the job.
Comments, forms, registrations. Same name, three separate problems, each with its own fix ahead.
A few years ago, a simple honeypot field caught most of what hit your forms. That's changing fast. Thales and Imperva's 2026 Bad Bot Report found AI-enabled bot attacks, ones built to generate realistic-looking submissions, mimic human browsing, and work around basic CAPTCHA, jumped 12.5 times year over year.
That doesn't make honeypots and time checks useless. It means they're now the first layer, not the only one. A bot that writes a convincing comment or fills out a contact form with plausible-sounding details slips past a hidden field the same way a real visitor would.
This is exactly where a filtering service like Akismet or CleanTalk earns its keep. Both check submissions against patterns learned across millions of sites in real time, which catches the submissions that look human enough to fool a static rule but still behave like spam everywhere else.
Comment spam, form spam, and registration spam get lumped together as "spam," but they're not the same problem wearing different clothes.
Comment spam shows up on published posts and pages, usually as a link dropped under someone else's content. Form spam hits your contact or lead forms directly, aimed at your inbox rather than your blog. Registration spam creates an account on your site, whether or not anyone ever logs into it again.
One plugin rarely covers all three well. That's why this guide handles each on its own.
Across the client sites we manage, comment spam almost always follows the same pattern. Generic praise, sometimes barely readable, attached to a link that has nothing to do with the post. Drop the link, hope it survives moderation, move on. We see this on nearly every site that still has comments open.
WordPress already has a setting built for exactly this. Go to Settings, then Discussion, and lower the number of links that automatically holds a comment for review. Two is the default. One catches far more of what we just described, since almost no real commenter needs to link out twice.
The same screen holds a few more free fixes. Require a name and email before anyone can comment. Hold new commenters for manual approval until you trust your filter. Add known spam phrases to the blocklist and it'll trash matching comments on its own. Pingbacks and trackbacks run on WordPress's XML-RPC interface, rarely bring real traffic, and get abused by spammers the same way comments do, so turn those off too.
If you don't need comments at all, close them under each page's Discussion panel instead of leaving the door open. Once these free settings stop being enough, that's the point to add a filter plugin like Akismet, not before.
Your contact form is different from your comment section. Nobody reads it for content, and its only job is to bring a real inquiry to your inbox. The goal here isn't zero spam. It's zero real leads lost, and those two goals pull against each other more than people expect.
Start with a honeypot. Most form builders, including WPForms and Gravity Forms, already add a hidden field that no human sees but almost every bot fills in anyway. It works quietly, catches almost nothing that would fool a person, and costs your visitors nothing.
Pair it with a time check. A real person takes a few seconds to read a form and type an answer. A bot fills every field before that time is up, so a short delay before a submission counts as a win against most automated spam.
CAPTCHA is the last layer, not the first. Akismet's own data shows removing CAPTCHA can lift conversion rates by 3.2%, which means every visible puzzle you add is a real cost, not a neutral one. Add Cloudflare Turnstile if spam volume forces your hand, since it runs invisibly for most visitors, but skip it while the two steps above are holding. One caution: a real Turnstile check looks similar at a glance to the fake "verify you're human" Cloudflare screens malware uses to trick visitors into running commands, so it's worth knowing the difference.
If you don't run a membership site, a store, or a community, the fastest fix is to turn registration off completely. Go to Settings, then General, and uncheck "Anyone can register." That one box ends the problem for most business sites, since there was never a real reason to let strangers create accounts in the first place.
If you do need open registration, require email confirmation or manual approval before an account goes live. A bot can fill out a form in under a second. It can't click a confirmation link in an inbox it doesn't control. Add the same honeypot and CAPTCHA setup you used on your contact form, and pair it with login protection, since both forms tend to attract the same bots on the same night.
Here's the part most spam guides skip. A forgotten fake account isn't always harmless clutter. We've found dormant accounts during cleanup work that turned out to be part of how a site was accessed in the first place, sitting unnoticed for months before anyone connected the dots. Bots don't just register to post links. Some are quietly testing whether a stolen email and password combination happens to work, and a subscriber account nobody's watching is exactly where that kind of reconnaissance hides.
If you run WooCommerce, guest checkout removes this risk for shoppers who never needed an account to buy something.
Not every site needs every fix in this guide. Here's what actually earns its place, by site type.
Site type | What to run |
|---|---|
Brochure or business site | Comments off, registration off, one lightweight contact form filter |
Blog or content site | Comment moderation on, Akismet or similar, trackbacks off |
Freelancer or agency site | Honeypot plus Turnstile on the contact form, a weekly glance at the spam folder |
WooCommerce store | Guest checkout on, a form filter on any lead forms, registration locked down |
Membership or community site | Email confirmation, admin approval, CAPTCHA on both registration and login |
Most sites need two of these rows, not five. Stacking every defense in this guide onto a five-page brochure site protects nothing extra and just adds maintenance.
Everything above works at the form or comment level, after a request has already reached your site. A firewall works earlier than that. A DNS-level firewall like Cloudflare, or a WordPress security plugin with firewall rules built in, screens traffic before it ever touches your forms, so a meaningful share of spam and bot traffic never gets the chance to submit anything at all.
That's a bigger topic than this guide, and it deserves its own space. For now, treat a firewall as the last layer behind everything else here, not a replacement for any of it.
Back up your site before any bulk deletion. This is the same rule we give for every cleanup task on this blog, and it matters here too, since emptying a spam folder or deleting users in bulk can't be undone.
Once you're covered, clear the spam comment queue, but skim it first. Filters catch real comments occasionally, and a quick scan costs you two minutes.
Then check your user list. Delete fake subscriber accounts freely, but stop before touching anything with elevated permissions you don't recognize. Investigate that account first. In our cleanup work, that's exactly the kind of account worth a closer look before it's gone for good.
After that, a five-minute monthly habit is enough: skim the spam folder, glance at new registrations, and move on.
Most of what's in this guide is a same-day fix. Turn off what you don't need, tighten the settings that are already there, and add one filter where the free options stop being enough. None of it requires a developer.
The part worth slowing down for is the one that touches security rather than annoyance: registration spam, and what a forgotten account might actually be doing on your site. If you're not sure whether your forms or your user list have already been hit, that's exactly what a security audit checks first.
Yes, to a point. The Discussion settings under Settings give you comment moderation, a link-count threshold, and a blocklist, all for free. None of that covers your contact forms or registration page on its own, which is why this guide treats them separately.
Both, depending on where it shows up. Comment spam is mostly a nuisance and an SEO problem. Registration spam can be more than that, since a forgotten fake account is occasionally a foothold rather than clutter, as covered above.
It can. Akismet's own data points to a 3.2% conversion lift from removing CAPTCHA entirely, which is why we recommend a honeypot and a time check first, and a CAPTCHA only once those aren't enough on their own.
Not at first. WordPress's built-in settings plus a honeypot handle most small sites for free. A paid plugin like Akismet or CleanTalk earns its cost once manual moderation starts eating real time every week.
Yes, if they're published or left to accumulate. Search engines read a comment section full of unrelated links as a trust signal, and it's not a positive one.
SEO & Security Expert, AppDeel
Azizul Hakim is an SEO and website security specialist at AppDeel, the agency he founded and where he still handles client work himself. For more than ten years he has helped business owners and eCommerce brands get found in search and keep their websites secure.
Read more posts by Md Azizul Hakim →Nulled WordPress themes and plugins ship with malware and backdoors built in. Here are 12 real reasons to avoid them, with the data behind each one.
WordPress supply chain attacks turned 30+ trusted plugins malicious in 2026. How they happen, how to spot one, and why updating alone isn't enough.
Japanese characters showing up in your Google results? Here is how to confirm the Japanese keyword hack, clean it properly, and get the spam pages deindexed.
Your WordPress site is redirecting to spam for visitors but looks fine to you. Here is how to prove it, find where the code hides, remove it, and confirm it is gone.
Tell us about your business today — get a free quote within 24 hours. No pressure, no confusing tech talk.
