Affiliate disclosure: Some of the links in this article are affiliate links that may provide us with a small commission at no cost to you. This is helping us to create free content to help you and manage the running cost of this blog. Thank you for your support.

Spam on a WordPress site comes through three doors: comments, contact forms and user registrations. Most guides throw one plugin at the problem.

A better approach is to close each door properly with settings first, then add one anti-spam tool for whatever gets through. Let us see how to protect your WordPress site from spam easily.

The Three Types of WordPress Spam

Type	What it looks like	Main fix
Comment spam	Link-stuffed comments, fake praise	Discussion settings + anti-spam plugin
Form spam	Junk contact or quote submissions	Honeypot + Turnstile/CAPTCHA + anti-spam
Registration spam	Fake user accounts	Disable registration or add verification

How To Protect Your WordPress Site From Spam

Step 1: Fix your built-in settings (free, 5 minutes)

Go to Settings > Discussion:

• Automatically close comments on posts older than 30 to 90 days. Old posts attract the most spam.
• Comments must be manually approved for first-time commenters (tick “Comment author must have a previously approved comment”).
• Hold a comment in the queue if it contains 2 or more links.
• Add common spam words to Comment Moderation (they’ll be held, not deleted).
• Consider turning off pingbacks and trackbacks (“Allow link notifications from other blogs”). They’re mostly spam today.

Go to Settings > General:

• Untick Anyone can register unless you run a membership site, store or forum that needs it.

That alone stops a lot of spam on a typical blog.

Step 2: Add one anti-spam plugin

Plugin	Price	How it works	Best for
Akismet	Free for personal sites; commercial plans from about $9.95/mo	Cloud check against Automattic’s spam database	Blogs on Jetpack/WordPress.com stack
Antispam Bee	Free, no paid tier	Local checks, no external service	Privacy-focused EU sites, simple blogs
CleanTalk	From about $12/year per site (trial first)	Cloud service covering comments, forms, registrations	Sites with spam across many forms
WP Armour	Free	Honeypot fields	Lightweight form protection
Titan Anti-Spam	Free; Pro about $55/year	Local + cloud checks	Budget all-rounder

Akismet

The default choice for many WordPress sites. Very accurate for comments and integrates with many form plugins.

The free plan is for personal, non-commercial sites only; sites with ads, affiliate links or products should use a paid plan. It is also on my list of must-have WordPress plugins.

Pros

• Accurate
• Low maintenance

Cons

• Commercial sites must pay
• Sends comment data to an external service (mention it in your privacy policy)

Antispam Bee

Free, open-source and processes everything locally. A strong pick for EU sites worried about data transfers.

Pros

• Free
• No account
• Privacy-friendly

Cons

• Comments only
• Doesn’t cover most form plugins

CleanTalk

One cloud service for comments, contact forms, registrations, WooCommerce checkout and more. Cheap per year.

Pros

• Wide coverage
• Low price

Cons

• No permanent free plan
• External processing

Pick one. Running several anti-spam plugins causes false positives and slower pages.

Step 3: Protect your forms

Contact forms are now the biggest spam target on most business sites.

• Turn on the form plugin’s built-in protection. WPForms, Gravity Forms, Formidable and Fluent Forms all include a honeypot and anti-spam token. Keep them on.
• Add Cloudflare Turnstile. It’s a free, mostly invisible CAPTCHA alternative, and most form plugins support it directly. It’s friendlier than reCAPTCHA image puzzles.
• Block by content with country, keyword or email-domain filters if your form plugin allows it.
• Connect Akismet or CleanTalk to your form plugin if it supports them.

Choosing a form plugin? My WordPress form builder plugins guide compares spam features.

Step 4: Stop registration spam

If you need open registration (store, LMS, membership):

• Add Turnstile or reCAPTCHA to the registration form
• Require email verification before accounts become active
• Set the default role to Subscriber (Settings > General > New User Default Role); never Administrator or Editor
• Review new users weekly and delete obvious bots

Step 5: Block bots at the edge

A security plugin or Cloudflare can stop many spam bots before they reach WordPress:

• Firewall rules and bot protection in Cloudflare
• Rate limiting on wp-comments-post.php and wp-login.php
• Block XML-RPC if you don’t use the WordPress mobile app or Jetpack features that need it.

My WordPress security plugins roundup covers firewall options.

Cleaning up Existing Spam

1. Go to Comments > Spam and click Empty Spam.
2. Bulk-delete pending spam (filter by date or author email).
3. For thousands of spam comments, a database cleanup plugin (WP-Optimize) can remove them faster.
4. Delete fake users from Users (filter by Subscriber and recent registration date) and reassign any content.

FAQs related to how to protect your WordPress site from spam

Conclusion

Spam is a settings problem before it is a plugin problem. Turn off what you do not use, moderate first-time commenters, close comments on old posts, and you will remove most of it without installing anything.

Then add one anti-spam plugin, not three. If you do not want comments at all, skip the filtering and disable comments in WordPress entirely.