Your moderation queue has four hundred items in it. You have not read a real comment in weeks, and you are not sure there was one.
Here is the thing worth saying first: a moderation queue is not protection. It is a place spam waits while you decide about it. The work still lands on you, the database still grows, and a real reader’s comment is still buried somewhere in it.
The goal is not a well-managed queue. It is spam that never arrives.
Why comment spam still exists
It is about links. A comment carrying a link on a page Google indexes is worth something to somebody, and the cost of trying is close to zero.
That economics explains three things people find puzzling:
Volume does not track your traffic. A blog with two hundred monthly readers gets comment spam because the bot is not reading your blog. It found a comment form.
Old posts get hit hardest. They have accumulated the most authority, and nobody is watching them.
Nofollow did not fix it. WordPress adds `rel=”nofollow ugc”` to comment links automatically. Spammers keep going anyway, partly because volume is free and partly because some of them are not chasing links at all — they are chasing the click from your readers.
Decide this first: do you need comments?
Most WordPress sites have comments enabled because it is the default, not because anyone wanted them.
Be honest about yours. If your last genuine comment was in 2023, the correct fix is not better filtering — it is Settings → Discussion → untick “Allow people to submit comments on new posts”, and then bulk-close them on existing posts.
That is a complete solution, it takes two minutes, and it costs you nothing you were actually using. A great many people spend years fighting a problem they could simply not have.
If comments genuinely matter to your site, read on.
What to turn on, in order
1. Close comments on old posts
Settings → Discussion → “Automatically close comments on articles older than X days.” Thirty to ninety days suits most sites.
The overwhelming majority of comment spam targets archives. Real discussion happens in the first days after publishing. This one setting removes most of the surface area, and it is free and built in.
2. A honeypot on the comment form
Invisible to a reader, filled in by a bot that completes every field. No puzzle, no third-party call, no cost to anyone genuine.
3. Timing
Nobody reads a post and writes a considered reply in 1.4 seconds. Rejecting submissions faster than a person could plausibly type removes a large share of automated comments.
4. Rate limits
One address leaving nine comments in a minute is not a reader. Limit by address and by network range — comment runs come from blocks of addresses, not single ones.
5. Link limits
A comment with five links is almost never a reader. WordPress has this built in — Discussion → “Hold a comment in the queue if it contains N or more links” — and the default of 2 is reasonable.
6. Disposable address detection
Genuine commenters use addresses they keep. Ten-minute mailboxes are a strong signal on their own.
Where Akismet fits, honestly
Akismet is the default for a reason: it works well on comments, it is mature, and for a personal blog the free tier is often enough.
Two things worth knowing before you rely on it:
It sends comment content to an external service to be scored. For most blogs that is a fair trade. For a site handling anything sensitive, or with strict data commitments to clients, it is a decision to make deliberately rather than by default.
It is comments-focused. Your login, registration, checkout and contact forms are separate problems, and you will need something else for those. If you are already running protection for your forms, having it cover comments too is usually simpler than running two systems.
There is no need to be tribal about this. If Akismet is handling your comments and you are happy with the trade, keep it.
What to do with the queue you already have
Empty Spam in the comments screen. Do not read them; that is the trap.
If the queue is enormous, delete in batches — a single query on tens of thousands of rows can time out on shared hosting.
Then check your `wp_comments` and `wp_commentmeta` tables. Years of accumulated spam leaves real weight behind even after deletion, and an optimise pass is worth running once.
How to tell whether it worked
Comment spam is seasonal and bursty. A quiet fortnight proves nothing, which is how people end up convinced a setting works when it does nothing.
Measure attempts rather than queue size. GatekeepWP scores comment submissions alongside forms, logins and registrations, and Monitor Mode records what it would have rejected without acting. That tells you whether the spam stopped or whether something is catching it — and if you are running Akismet, it will also show you what gets past it, which nothing else will tell you.
Frequently asked questions
Should I just turn comments off? If you cannot remember your last genuine comment, yes. Settings → Discussion, untick comments on new posts, and bulk-close them on old ones. It is a complete fix for a problem you were not benefiting from.
Does nofollow stop comment spam? No. WordPress already adds `rel=”nofollow ugc”` automatically. Spammers continue because attempts cost nothing and some are chasing reader clicks rather than search value.
Is Akismet enough on its own? For comments on a personal blog, often yes. It does not cover forms, logins, registration or checkout, and it scores comments by sending them to an external service.
Why do old posts get the most spam? They have the most accumulated authority and the least supervision. Auto-closing comments after 30 to 90 days removes most of that surface.
Will blocking spam comments hurt my SEO? No. Spam comments do the harm — thin duplicated content, links to bad neighbourhoods and slower pages. Removing them helps.
TL;DR — Decide whether you need comments at all. If you do: auto-close old posts, add a honeypot, timing, rate and link limits. A moderation queue hides the problem rather than solving it.
Related: Fake user registrations on WordPress — accounts are often created specifically to get past comment moderation.
Try it: GatekeepWP scores comments, logins, registrations and every form from one install, on your own server, with no external calls. Free, no API key.
