How to Reduce WordPress Login and Comment Spam

Most WordPress sites receive automated spam comments and login attempts. You can’t stop bots trying, but a few settings stop them succeeding and keep spam off your pages.

Part 1: Comment spam

1. Go to Settings → Discussion.
2. If you don’t want comments at all, uncheck Allow people to submit comments on new posts. This only affects new posts. For older posts, see the next list.
3. Under Before a comment appears, check Comment must be manually approved. If you’d rather not approve every comment by hand, check Comment author must have a previously approved comment instead.
4. Under Comment Moderation, set Number of links to allow in a comment before holding for moderation to 1. With 1, any comment that contains a link waits for your approval. Links are a common sign of spam.
5. Check Automatically close comments on old posts and set Close comments when post is how many days old, for example 30.
6. Click Save Changes.

To turn comments off on posts you already published:

1. Go to Posts → All Posts.
2. Check the box at the top of the list to select every post on the page.
3. Choose Bulk edit from the Bulk actions menu and click Apply.
4. Set Comments to Do not allow, then click Update.

Then add a spam filter for what’s left:

1. Go to Plugins → Add Plugin and search for “anti-spam”.
2. Choose one with many Active Installations and a recent Last Updated date.
3. Click Install Now, then Activate.

Part 2: Login attacks

First, make sure no administrator uses the username admin.

1. Go to Users and look at the Username column. If no administrator is called admin, skip to the next list.
2. Go to Users → Add User. Create a user with a different username, set Role to Administrator, and click Add User.
3. Log out, then log in as the new user.
4. Go to Users, point to the admin user and click Delete.
5. Choose Attribute all content to another user, pick your new user, and click Confirm Deletion.

Then protect every administrator account:

1. Give every administrator a long, unique password, ideally from a password manager.
2. Turn on two-factor sign-in (a code from an app on your phone) for every administrator. WordPress needs a plugin for this. Choose one the same way as the spam filter above.
3. Remove administrator rights from anyone who doesn’t need them. Go to Users and click Edit under their name.
4. Change Role to Editor or Author, which is enough for most writers. Click Update User.
5. Keep WordPress and plugins updated (see how to update WordPress safely).

Part 3: Contact form spam

Turn on your form plugin’s spam protection. Examples are a hidden “honeypot” field (a box people can’t see but bots fill in) or a challenge (a quick check people can pass but bots can’t). Also look in the form’s settings for an option to block messages that contain links.

How to tell it worked

Over the next week, new spam comments wait under Pending or Spam on the Comments screen. They don’t appear on your site. Every administrator is asked for a second code when they log in.

Troubleshooting

• Genuine comments disappear: on the Comments screen, check the Spam and Trash views and click Not Spam or Restore, then adjust Disallowed Comment Keys or your anti-spam plugin’s settings.
• You lost your two-factor device: use the backup codes you saved when you set it up. Otherwise, ask another administrator to turn off two-factor sign-in for your user, or open a support ticket. Resetting your password usually doesn’t turn off two-factor sign-in.
• Unknown administrators appear: treat the site as hacked. Change your own WordPress password, then open a support ticket straight away. Include the unknown usernames and when you first saw them.
• Form notifications stop arriving: see WordPress email not sending.

Still need help?

Open a support ticket from the Client Portal at my.bluearctic.com. Include your site address, what kind of spam you see, which plugins you use for comments, forms and security, and what you already tried. Never include a password.