How Do You Stop Spam Comments and Fake Form Submissions on WordPress?

The most reliable way to stop spam on WordPress is to layer a few light defences: turn off comments you do not need, add an invisible honeypot or a spam filter such as Akismet, and put simple limits on your forms. You rarely need an annoying puzzle that frustrates real customers. Here is how to set it up properly.

Why does WordPress attract so much spam?

WordPress powers a huge share of the web, so spammers write bots that hunt for its standard comment forms and contact forms. The bots are not interested in your business. They are after links to put on your site, or a free way to send junk email through your forms.

The result is a cluttered inbox, a comments queue full of nonsense, and sometimes a hit to your reputation if spam links go live. It can also hide genuine enquiries among the noise, which is the real cost for a small business.

Step 1: Decide whether you need comments at all

Most business websites do not benefit from open comments. If nobody is joining the conversation, switch them off. In WordPress, go to Settings, then Discussion, and untick the option to allow people to submit comments on new posts. For existing posts, use the bulk edit option in the Posts list to close comments in one go.

Also turn off pingbacks and trackbacks. They are an old feature that spammers still abuse, and few sites miss them.

Step 2: Tighten your comment settings if you keep them

If comments are part of your content strategy, a few settings make a big difference:

• Require comment authors to fill out their name and email.
• Hold a comment for moderation if it contains two or more links.
• Require manual approval for a commenter’s first comment.
• Automatically close comments on posts older than 30 or 60 days, since old posts are a favourite target.

Add a list of words you commonly see in spam to the disallowed comment keys box, and those comments are sent straight to the trash.

Step 3: Add a spam filter

Akismet is the best-known option. It checks each comment against a large database of known spam and quietly moves the bad ones aside. Note that it is free for personal sites but needs a paid plan for commercial use, so check the current terms before you install it on a business site.

Other well-regarded options include Antispam Bee, which is privacy friendly, and the filtering built into your security plugin. Pick one and run it well rather than stacking several, because overlapping spam plugins can slow your site and cause false positives.

Step 4: Protect your contact forms

Fake form submissions are a different problem from comment spam, and they need their own protection. Good options, roughly from least to most intrusive for visitors, are:

1. A honeypot field. A hidden field that real people never see but bots fill in. Submissions that complete it are rejected. Most quality form plugins include this.
2. A time check. Bots submit forms instantly. Rejecting anything sent in under a couple of seconds catches many of them.
3. An invisible challenge. Services such as Cloudflare Turnstile or reCAPTCHA v3 score visitors in the background without asking them to click traffic lights.
4. Email verification. Reserve this for forms where a fake entry would cause real harm, such as bookings.

Start with the first two. If spam persists, add an invisible challenge. Be careful with any tool that loads third-party scripts, and mention it in your privacy policy if it does.

Step 5: Make sure real enquiries still arrive

Aggressive filtering can catch genuine customers. After any change, send yourself a test enquiry from a different email address and check that it arrives. Look in your spam folder and your form plugin’s entries log now and then, too. If real messages are being blocked, loosen the rules a little.

If your form notifications are landing in junk, that is a separate issue. Our guide on why website emails go to spam covers it, and our post on why nobody is filling in your contact form is also worth a look.

Step 6: Keep the basics in order

Spam protection works best on a site that is otherwise well looked after. Keep WordPress, themes and plugins updated, delete plugins you do not use, and use strong logins. Our WordPress development and maintenance work covers this routine, and if you are building something new, our WordPress web design service includes sensible spam protection from day one.

If you also run a business website elsewhere and want a second opinion on security, the team at Defyn Digital works in the same space.

Need a hand?

If spam is swamping your inbox or hiding real enquiries, we can sort it out without making your site harder to use. Call us on 02 9834 4119 or get in touch through our contact page.