How to reduce WordPress spam comments and form spam

You open your WordPress dashboard and see 347 comments waiting for moderation, all offering cheap pills, crypto schemes or links to strange websites. Meanwhile your contact form inbox is full of fake enquiries, and somewhere in the middle is a genuine customer from Mbarara asking for a quote. Spam wastes time, hides real leads and can even damage your site's reputation. This guide shows you how to reduce WordPress spam comments and form spam using layered defences that are practical for Ugandan business websites, schools, NGOs and bloggers.

Why WordPress sites attract so much spam

Spam is mostly automated. Bots crawl the web looking for comment boxes and forms, then submit junk in bulk. They are not targeting you personally. WordPress is popular, so its default comment and form fields are easy for bots to recognise. The goal of spam protection is to make your site harder for bots while staying easy for humans.

Part 1: Reduce WordPress comment spam

Step 1: Decide whether you need comments at all

Many business websites do not need comments. A hardware shop, a law firm or a hotel rarely benefits from blog comments. If that is you, turn them off completely:

1. Go to Settings, Discussion.
2. Untick "Allow people to submit comments on new posts".
3. Untick "Allow link notifications from other blogs (pingbacks and trackbacks)".
4. For existing posts, go to Posts, select all, choose Edit under Bulk actions and set Comments to "Do not allow".

This single change can remove nearly all comment spam overnight.

Step 2: Tighten discussion settings

If you want comments, adjust these options in Settings, Discussion:

• Tick "Comment author must fill out name and email".
• Tick "Comment must be manually approved" or "Comment author must have a previously approved comment".
• Set "Hold a comment in the queue if it contains 1 or more links". Spam almost always includes links.
• Tick "Automatically close comments on articles older than" and choose something like 30 or 60 days. Old posts attract the most bot spam.
• Use the Disallowed Comment Keys box to block common spam words.

Step 3: Install an anti spam plugin

A good anti spam plugin checks each comment against known spam patterns. Options include Akismet, Antispam Bee and others. Choose one that is actively maintained and well reviewed. Note that some services require a paid plan for commercial sites, so check the terms. Install only one main anti spam plugin to avoid conflicts.

Step 4: Remove the website field

Spammers love the "Website" field because it gives them a link back to their site. A small code snippet or a lightweight plugin can remove it from the comment form without affecting genuine commenters.

Part 2: Reduce contact form spam

Form spam is often more painful because it lands in your email inbox and can bury real enquiries.

Step 5: Add a honeypot field

A honeypot is a hidden field that humans cannot see but bots fill in automatically. When the field has content, the form rejects the submission. Most popular form plugins, such as Contact Form 7, WPForms, Fluent Forms and Gravity Forms, have honeypot options built in or available through add ons. It is invisible to visitors and very effective against basic bots.

Step 6: Use a CAPTCHA or invisible challenge

For stronger protection, add a challenge service:

• Google reCAPTCHA v3 runs invisibly and scores visitors in the background.
• Cloudflare Turnstile is a privacy friendly alternative that usually requires no puzzle.
• hCaptcha is another widely used option.

Prefer invisible or low friction options. Many Ugandan visitors browse on mobile data, and slow image puzzles frustrate genuine customers.

Step 7: Add simple validation rules

• Make the phone field accept only numbers, and use a placeholder like 07XX XXX XXX.
• Limit message length to stop bulk text dumps.
• Block submissions containing many links.
• Use a dropdown such as "What service are you interested in?" which bots often fill incorrectly.

Step 8: Block repeat offenders

Some form plugins and security plugins allow you to block specific email addresses, domains, keywords or countries. Use this carefully. Blocking entire countries may stop real clients, such as diaspora customers or international partners.

Step 9: Use a firewall or security plugin

A web application firewall stops many bots before they even reach your forms. Options include security plugins such as Wordfence and services such as Cloudflare. Good hosting helps here too. Servers that block known bad traffic at the server level reduce the load on your site.

Part 3: Protect the rest of your site

• Disable user registration if you do not need it. Go to Settings, General and untick "Anyone can register". Fake registrations are another common spam problem.
• Keep WordPress, themes and plugins updated. Outdated forms and plugins can be exploited to send spam from your site.
• Use proper email sending. Set up SMTP with your business email so form notifications are delivered reliably and do not land in spam themselves.
• Remove unused forms on old landing pages.

A layered approach that works

No single tool stops all spam. Combine layers for the best results:

1. Turn off what you do not use, such as comments, pingbacks and registration.
2. Add a honeypot to every form.
3. Add an invisible challenge such as Turnstile or reCAPTCHA v3.
4. Run one trusted anti spam plugin for comments.
5. Protect the site with a firewall and good hosting.

Review spam weekly for the first month to fine tune settings, then monthly.

Cleaning up existing spam

If you already have thousands of spam comments, go to Comments, click the Spam or Pending tab, and use "Empty Spam" or bulk delete. Large amounts of stored spam can bloat your database and slow your site. Consider a database cleanup afterwards, and take a backup first.

Frequently asked questions

Will a CAPTCHA reduce my genuine enquiries?

Visible puzzles can annoy some visitors. Invisible options like reCAPTCHA v3 or Turnstile rarely affect real users, so they are a better choice for business sites.

Why am I still getting spam after adding a CAPTCHA?

Some spam is sent by real people paid to fill forms, which CAPTCHAs cannot stop. Keyword filters, link limits and manual moderation help with that.

Is spam dangerous to my website?

Spam itself is mostly a nuisance, but links in approved spam comments can harm your search reputation, and a flood of submissions can slow your server.

Should I turn off comments to improve SEO?

Turning off comments does not hurt SEO for most business sites. Genuine, moderated discussion can add value on a blog, but spam does the opposite.

Conclusion

To reduce WordPress spam comments and form spam, start by switching off features you do not need, then add honeypots, invisible challenges, an anti spam plugin and a firewall. With these layers in place, your inbox becomes a place for real customers again.

Baasa Cloud WordPress hosting runs on LiteSpeed servers with daily backups and local support, and our team can help you set up spam protection and reliable form email delivery.