How to Set Up WordPress Comments and Prevent Spam

WordPress enables comments on all posts by default, but very few sites need them without some configuration first. Left unchanged, the default settings invite spam bots, low-quality submissions, and a moderation burden that quietly grows until it’s taking real time to manage.

The good news is WordPress has solid built-in controls for this. A handful of settings in the Discussion panel handle most problems before they start, and a single spam-filtering plugin handles the rest. You don’t need a stack of plugins — just the right settings and one reliable tool.

This guide covers how to configure comment moderation, how to cut spam volume significantly, and how to decide whether to enable comments at all. Managing comments properly is one of those setup steps that saves real time later — and it’s part of the step-by-step approach to building and maintaining a WordPress website that holds up over time.

Quick Answer

Go to Settings > Discussion in your WordPress admin and configure who can comment, what gets held for moderation, and what gets automatically blocked. Install Akismet for automated spam filtering. If comments aren’t central to your site, turn them off entirely — you can always re-enable them later.

Why This Matters

Comment spam isn’t just an annoyance. It clutters your database, slows down admin pages, and can introduce links to malicious or low-quality sites if submissions slip through moderation. Sites that appear in search results with obvious spam in their comment sections take a reputational hit that’s hard to undo.

On the other hand, comment sections on niche blogs, tutorials, or knowledge bases can genuinely add value — readers asking questions, sharing experiences, adding context the original post didn’t cover. The goal is to configure comments so they work with minimal overhead, not against you.

Configure the WordPress Discussion Settings

Go to Settings > Discussion in your WordPress admin. This is where the core comment behaviour is controlled.

Comment Permissions

• Comment author must fill out name and email — Enable this. It filters out the lowest-effort bot submissions immediately.
• Users must be registered and logged in to comment — Enable this if your audience creates accounts on your site. Leave it disabled on public-facing blogs where you want open discussion.
• Automatically close comments on posts older than X days — Enable this and set it to 90–180 days. Old posts attract disproportionate spam volume; closing them removes a major entry point.

Moderation Settings

• Hold a comment in the moderation queue if it contains X or more links — Set to 1 or 2. Spam almost always contains links, so catching link-heavy comments early is reliable.
• Comment must be manually approved — The safest setting for low-volume sites. Every submission waits in the queue before going live, which gives you full control.
• Comment author must have a previously approved comment — A practical middle ground for active communities. First-time commenters go into the queue; returning commenters post immediately.

Comment Blocklist

Scroll to the Comment Blocklist section. Any comment containing words, URLs, email addresses, or IP addresses you list here gets sent to spam automatically. Add terms that recur in your spam folder — phrases like “SEO service”, “buy cheap”, or specific domains that keep showing up. This blocklist is case-insensitive and runs before Akismet, so it catches patterned spam instantly.

Install Akismet for Automated Spam Filtering

Akismet is pre-installed on most WordPress sites and handles the bulk of automated spam without ongoing effort. It checks each submission against a global database of known spam patterns and quietly catches what your manual settings miss.

1. Go to Plugins > Installed Plugins and find Akismet Anti-Spam.
2. Click Activate.
3. Navigate to Settings > Akismet Anti-Spam and enter your API key.
4. Get a free API key at the Akismet plugin page — personal site use is free.
5. Save your settings. Akismet begins filtering immediately.

Once active, Akismet shows a running count of spam caught in the plugin dashboard. Most sites running Akismet see near-zero spam reaching the moderation queue within the first few days.

Disabling Comments Where You Don’t Need Them

Comments don’t have to be all-or-nothing across your entire site. WordPress lets you control them per post and per page.

To disable comments globally on new content: Go to Settings > Discussion and untick “Allow people to post comments on new articles”. This affects all future posts. For existing posts, open the post list view, enable the Comments column via Screen Options, select all posts, and use Bulk Edit to disable comments.

To disable on individual posts or pages: Open the editor, find the Discussion panel in the sidebar (enable it via Screen Options if it’s hidden), and untick “Allow comments”. For most pages — About, Contact, Services — comments should be disabled outright. They’re rarely used legitimately on pages and accumulate spam at the same rate as posts.

Practical Tips

• Check the spam folder weekly. Akismet occasionally catches legitimate comments. A quick scan once a week is usually enough to spot false positives before they’re auto-deleted.
• Use email + name fields as a baseline filter. Requiring a name and email address stops the most basic bot submissions without inconveniencing real visitors.
• Layer your defences upstream. A firewall blocks spam bots before they reach the comment form — it’s the upstream layer that reduces load on Akismet. Setting up a WordPress firewall is a useful next step once comments are configured.
• Protect the login system too. If comment submission requires registration, brute-force attacks on the login form become a related concern. Limiting login attempts protects the account system that registered comment posting relies on.
• Don’t rely on CAPTCHA alone. CAPTCHAs frustrate genuine users and don’t stop sophisticated bots. Akismet plus proper moderation settings handles more volume with less user friction.

Common Mistakes

• Leaving default settings unchanged. WordPress’s out-of-the-box comment settings are permissive. If you’ve never reviewed the Discussion page, it’s likely configured in a way that lets most spam through.
• Not closing comments on old posts. Posts older than a few months are prime spam targets. The automatic closing setting is one of the highest-impact changes you can make in the Discussion panel.
• Ignoring the spam queue. A growing spam folder with thousands of entries slows database queries and admin page loads. Review and empty it regularly.
• Assuming Akismet covers everything. Akismet is excellent but not infallible. The Discussion settings and your blocklist are the first line of defence — Akismet is the second. Running a WordPress security audit periodically will surface any gaps in your overall configuration.

When to Enable Comments vs When to Turn Them Off

Enable comments when your site has a community component — a blog with regular readers, a niche tutorial site where reader questions add value, or a course site where learner discussion is part of the experience.

Disable comments when your site is primarily for business leads, portfolio display, or content consumption without interaction. Most landing pages, service sites, and ecommerce stores don’t benefit from open commenting, and the moderation overhead rarely justifies it. If you’re unsure, disable them and revisit after a few months. Enabling comments later is simple; cleaning up a backlog of spam after leaving them open is not.

Comment moderation only covers one half of the spam problem — the other is your login page. If bots are also probing your login form, see adding a CAPTCHA to your WordPress login and comment forms for a way to block both at once.

Conclusion

A properly configured comment section runs quietly with minimal maintenance. Set the moderation rules once, activate Akismet, close old posts automatically, and you’ll handle the vast majority of spam without ever needing to think about it again.