WordPress Comment Spam: Set Up Akismet the Right Way

If your inbox is full of comment-moderation emails for posts about crypto trading and knockoff sneakers, you're not imagining it — WordPress comment spam has gotten worse, not better, and default settings won't stop it. Here's how to actually fix it, not just filter it after the fact.

Symptom: What This Actually Looks Like

A few signs you're dealing with a real spam problem and not just the occasional stray comment:

• Dozens (or hundreds) of pending comments in Comments → Pending, most with generic praise ("Great article!") and a spammy link in the name or website field.
• Comments landing on posts that are years old and nobody's actively reading.
• A sudden spike in wp_comments table size when you check phpMyAdmin.
• Slower wp-admin load times on the Comments screen because you're rendering 2,000+ rows.
• Legitimate readers giving up on commenting because your moderation queue is such a mess you never approve real ones in time.

Why It's Happening

Comment spam isn't random — it's automated, and it targets specific gaps in a default WordPress install.

1. No bot check on the comment form

Out of the box, WordPress's comment form has no CAPTCHA, no honeypot, nothing. A script can POST straight to wp-comments-post.php all day without ever loading your page in a browser.

2. Pingbacks and trackbacks are still on

These are a legacy feature that lets other sites "notify" your post when they link to it. In practice, it's one of the easiest spam vectors left in WordPress, and almost nobody uses it for its original purpose anymore.

3. Comments never close

By default, comments stay open on every post forever. A 2019 blog post with open comments and no active moderation is exactly what spam bots go looking for.

4. No moderation keys or blacklist

WordPress has a built-in keyword/IP blocklist for comments, but almost nobody sets it up, so it does nothing.

The Fix: Akismet, Configured Properly

Akismet is bundled with WordPress but not activated by default, and most people who do activate it never touch the settings beyond pasting in an API key. That's leaving performance on the table.

Step 1 — Get an API key

Go to akismet.com and sign up. Personal/blog use is free; commercial sites need a paid plan based on traffic. Copy the API key it gives you.

Step 2 — Activate and connect

In wp-admin, go to Plugins, find Akismet Anti-Spam (it ships with core WordPress), and activate it. Then go to Settings → Akismet Anti-Spam and paste your key.

Step 3 — Turn on strict mode

Under Akismet's settings, enable "Silently discard the worst and most pervasive spam". Without this, Akismet flags obvious garbage as "spam" but still puts it in your queue for review — strict mode deletes the worst offenders outright and only queues borderline cases.

Step 4 — Confirm it's actually running

Check Comments → Spam after a day or two. If Akismet is working, spam should start landing there automatically instead of in Pending. If nothing's showing up in Spam and Pending keeps growing, your API key isn't validating — recheck it under Akismet settings, which shows a green "connected" status when it's live.

Beyond Akismet: Layer These On Top

Akismet catches most spam, but a few settings changes stop a lot of it before it even reaches Akismet's servers.

Turn off pingbacks and trackbacks

Go to Settings → Discussion and uncheck "Allow link notifications from other blogs". That only affects new posts. To kill it site-wide, add this to your theme's functions.php or a small site-specific plugin:

add_filter('xmlrpc_methods', function ($methods) {
    unset($methods['pingback.ping']);
    return $methods;
});
add_action('init', function () {
    if (!empty($_SERVER['HTTP_X_PINGBACK'])) {
        header_remove('X-Pingback');
    }
});

Auto-close comments on old posts

In Settings → Discussion, check "Automatically close comments on posts older than X days" and set it to something like 60 or 90. Almost no genuine reader comments on a post that old anyway, and it removes thousands of stale targets.

Use the Disallowed Comment Keys list

Still in Settings → Discussion, scroll to Disallowed Comment Keys. Any comment containing a word, URL, or IP address you list here is trashed automatically, no Akismet lookup needed. Common entries worth adding:

viagra
casino
forex
crypto signals
replica watches
SEO services

This is a blunt instrument — don't add words your real commenters might use — but for the obvious spam categories it's an easy first filter.

Block direct posts to wp-comments-post.php

A lot of spam scripts skip loading your page entirely and POST directly to the comment handler. You can require a matching referrer at the server level. In your site's .htaccess (Apache/LiteSpeed):

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} ^/wp-comments-post\.php
RewriteCond %{HTTP_REFERER} !^https://yourdomain\.com [NC]
RewriteRule (.*) - [F]
</IfModule>

Replace yourdomain.com with your actual domain. This blocks a large share of the dumbest bots without touching real visitors, who always arrive with your own site as the referrer.

Add a honeypot field (no extra plugin needed)

Most spam bots fill in every field they find. A hidden field that real browsers never see — but bots fill in anyway — is a reliable, low-overhead trap:

add_action('comment_form_after_fields', function () {
    echo '<p style="display:none;"><label>Leave this field empty</label>';
    echo '<input type="text" name="hp_check" value=""></p>';
});
add_filter('preprocess_comment', function ($commentdata) {
    if (!empty($_POST['hp_check'])) {
        wp_die('Spam detected.');
    }
    return $commentdata;
});

Already Flooded? Clean Up the Backlog

If you're staring at thousands of spam comments right now, don't click through them one by one.

If you have SSH/WP-CLI access, delete everything already marked spam in one shot:

wp comment delete $(wp comment list --status=spam --format=ids) --force

To also clear the trash (comments deleted but not yet purged):

wp comment delete $(wp comment list --status=trash --format=ids) --force

No SSH access? Open phpMyAdmin from cPanel, select your WordPress database, and run:

DELETE FROM wp_comments WHERE comment_approved = 'spam';
DELETE FROM wp_comments WHERE comment_approved = 'trash';

Replace wp_comments with your actual table prefix if it isn't the default wp_. After a big cleanup like this, run Tools → Optimize Table on wp_comments in phpMyAdmin to reclaim disk space.

Prevention Checklist

None of these alone is bulletproof. Together, they cut spam down to a trickle you can moderate in a couple of minutes a week instead of an hour.