Two hundred pending WordPress spam comments, all of them nonsense, most of them advertising things you would not repeat. Comment spam is rarely dangerous and it is frequently decisive, because it is the reason a lot of small business owners stop opening their dashboard at all — and a dashboard nobody opens is a site nobody maintains.
Knowing how to stop WordPress comment spam takes about ten minutes, and for many sites the right answer is more direct than people expect.
First decide whether you want comments
This is the question to answer before configuring anything, and it is worth being honest about it.
Most small business websites get no genuine comments. Not few — none. Discussion happens on WhatsApp, on Instagram, in the enquiry form and on the phone. If your site has been live for a year and every comment you have ever received was spam, comments are not a feature you are using. They are a form you left switched on.
Choosing to disable WordPress comments entirely is a legitimate decision, not an admission of defeat. It removes the problem permanently rather than managing it forever.
Keep them if you genuinely publish content people respond to, or if the comments themselves add something a reader would want. Otherwise, switch them off and move on.
If you are switching them off
Two settings, and the second is the one people miss. Disabling comments in the discussion settings stops new posts from accepting them — it does not affect anything already published. Every existing page keeps its comment form open unless you also close comments on existing content in bulk, which the post list lets you do in one action.
Do both, or you will keep receiving spam on the pages that have been there longest, which are exactly the ones the spam bots know about.
If you are keeping them
Four settings between them stop the overwhelming majority, and none of them inconvenience a real reader.
- Hold the first comment from anyone for approval. Nothing appears publicly until you have seen it once. This alone removes the incentive for most automated spam, which exists to publish links.
- Turn on a spam filter. Akismet is the usual choice and is free for a non-commercial site. It catches the bulk automatically.
- Close comments on posts older than a set number of days. Real discussion happens in the first week or two. Almost all spam arrives on posts that are months or years old, and this setting removes that entirely.
- Require a name and email. Trivial to defeat and still worth having, because it filters the least sophisticated attempts.
Avoid a visible CAPTCHA if you can. It costs real readers more than it costs the bots, and the settings above achieve more without asking anyone to identify a traffic light.
Clearing the backlog
Empty the spam queue and delete the pending pile in bulk rather than reviewing two hundred entries individually. If you are worried about losing something genuine, sort by date and skim the oldest few — real comments cluster near a post’s publication, spam does not.
Then check the database afterwards. A large spam backlog leaves rows behind even once deleted, and clearing them is part of WordPress database optimization.
Contact forms are not comments
Worth separating, because switching comments off makes some owners nervous that they are closing a channel. They are not the same system. Turning comments off has no effect on your contact form, your WhatsApp button, your booking form or your checkout. Those are separate plugins with separate settings.
Spam does reach forms as well, and it needs a different answer: a honeypot field the visitor never sees, or a quiet challenge. Our note on why a contact form stops sending covers why over-aggressive filtering there costs you real enquiries in a way comment filtering never does.
Why it matters more than it looks
Spam is not usually a security problem. It is an attention problem. An owner who has stopped opening the dashboard because it is full of noise is also not seeing the plugin updates, the failed backup notice, or the message from a real customer who used the comment form because they could not find the contact page.
Keeping the dashboard quiet is what makes everything else on the maintenance list get done. That is the case for keeping the site tidy each month rather than treating it as cosmetic.