Every new WordPress site starts collecting spam comments within weeks. It does not mean you are hacked — bots simply crawl every site. Here is how to stop it, depending on whether you need comments at all.
First: do you even need comments?
Honestly — for 80% of business sites (services, stores, business cards) comments bring nothing. The discussion happens on Facebook and Instagram. If that is your case — switching them off is the best fix.
Solution 1: turn them off (cleanest)
- For new posts: Settings → Discussion → untick allow people to submit comments
- For existing ones: Posts → select all → Edit → Comments: Do not allow → Update
- Or the Disable Comments plugin — one button, gone everywhere
Solution 2: if you want comments
- Akismet — ships with WordPress; free for personal sites, catches over 95% of spam
- Settings → Discussion: comment must be manually approved — nothing appears without you
- Close comments on posts older than 30 days (same page) — old posts are the main target
- Require a name and email; disallow HTML links
Solution 3: against a flood
If you get hundreds a day and the server strains: cPanel or a security plugin can block wp-comments-post.php for external requests. This is a step we take for clients under attack — not for solo experimenting.
What never to do
Do not approve spam comments to fake activity — links to shady sites damage your reputation with Google. And do not reply: they are bots.
A detail
If you have hundreds of spam comments pending: Comments → Spam → Empty spam. A bloated database slows everything; clearing it is instant relief.