Quick answer
First distinguish WordPress comments from contact-form submissions, reviews, and newsletter signups. Each can have a different spam-control system, so changing Discussion settings may not affect a separate form plugin.
Before you start
Save the current settings and a sanitized example. Decide whether the website actually needs public comments, whether registration is appropriate, and who will moderate genuine submissions.
Steps
- Open Settings, Discussion and review new-comment permissions, moderation requirements, link limits, and notification recipients. Compare those defaults with settings on existing posts.
- For a site that does not use comments, disable new comments where appropriate and separately review older posts that still permit them. Preserve genuine historical comments unless removal is approved.
- If comments remain enabled, configure the supported moderation or approved anti-spam tool. Review any external service's data handling, plan limits, and accessibility impact before enabling it.
- Test a normal comment, a held-for-review comment, and the moderator notification. Check keyboard operation and avoid a challenge that prevents legitimate visitors from participating.
Verify the result
A genuine visitor should receive clear feedback, and the moderator should see the expected queue. Measure spam reduction without treating every blocked submission as proof of a malicious person.
Troubleshooting and recovery
If spam continues through a contact form, inspect that form's own controls instead. Do not delete all submissions or block broad geographic ranges as a substitute for identifying the submission route.
Related help
- Review form labels, instructions, and error messages
- Prepare a useful report when a website may be compromised
- Update a WordPress plugin with a clear rollback plan
Official references
Reviewed October 31, 2026. Interfaces, vendor availability, and account features can change. Check your current account before making changes.
