How to Stop WordPress Comment Spam (Without Relying on Akismet)

Comment spam is the oldest spam problem on WordPress — bots posting promotional links, fake reviews, or scraped nonsense text under your blog posts. Akismet is the default fix most people reach for, but it’s not the only option, and it’s worth understanding what’s actually happening before picking a tool.

Why comment sections get targeted

Blog comment fields are an easy target because they’re public, often unmoderated by default, and a comment with a link in the author-website field passes a tiny bit of authority to whatever site it points to — which is exactly what spam networks are trying to farm. The more comments your blog gets organically, the more attractive it is to automated spam tools.

Built-in WordPress settings to check first

Before installing anything, a few native settings reduce spam significantly:

• Settings → Discussion → “Comment must be manually approved” — every comment from a new commenter goes into a moderation queue first. Effective, but adds manual work if your blog gets a lot of legitimate comments too.
• Settings → Discussion → “Comment author must have a previously approved comment” — once someone’s first comment is approved, future ones go through automatically. A good middle ground.
• Settings → Discussion → Disallowed Comment Keys — a list of words, IPs, or URLs that automatically sends matching comments to the trash or spam queue. Useful for blocking known spam patterns specific to your site.
• Close comments on old posts — under Settings → Discussion, automatically close comments on posts older than a set number of days. Most comment spam targets old posts because they’re indexed and forgotten, not because anyone’s actually engaging with them.

Plugin options

Akismet

The default choice, built by Automattic (the company behind WordPress.com). It checks every comment against a constantly updated database of known spam patterns. Free for personal sites, paid tiers for commercial use. Works well for typical bot-driven comment spam but offers limited visibility into why something was flagged, and it’s not built to evaluate more nuanced cases.

Antispam Bee

A free, GDPR-compliant alternative that processes everything locally on your server instead of sending data to a third-party API. Uses heuristic checks — keyword patterns, link counts, blacklist matching — rather than a centralized database. A solid choice if you want to avoid sending visitor data off-site.

Honeypot-based plugins

Plugins like WP Armour or similar honeypot tools add an invisible field to the comment form that bots fill in automatically but humans never see. Anything that fills it gets blocked. Zero impact on real commenters, and it catches a meaningful share of unsophisticated bots with no ongoing maintenance.

reCAPTCHA-based comment plugins

Adds a CAPTCHA challenge (or invisible v3 scoring) to the comment form itself. More friction than a honeypot, but effective against more advanced bots that a honeypot alone won’t stop.

A simple stack that covers most cases

1. Turn on “Comment author must have a previously approved comment” (free, built-in)
2. Add a honeypot plugin (free, invisible to users)
3. Add Akismet or Antispam Bee as a second layer for anything that gets past the honeypot
4. Use Disallowed Comment Keys to block recurring spam patterns specific to your site

This combination catches the vast majority of comment spam without adding visible friction for real commenters, and it doesn’t depend on any single tool.

When comment spam isn’t your real problem

If your site doesn’t rely on comments for engagement, the simplest fix is disabling them entirely under Settings → Discussion. It removes the attack surface completely and is worth considering for business sites where comments aren’t core to the content strategy — that effort is often better spent protecting contact forms and lead forms instead, which is where most B2B sites actually lose value to spam and fake leads.

If form spam and fake leads are the bigger issue on your site: Spamvora handles that side of WordPress spam protection — see how it works.