Control WordPress comment spam with a reviewable moderation workflow

Decide where comments belong

A tutorial may benefit from readers reporting a confusing step. A contact page may already have a better route for enquiries, while an old announcement may no longer need an open thread. Keep discussion where someone can review and answer it rather than enabling it everywhere by habit.

In Settings → Discussion, review Allow people to post comments on new articles. This is a default for new content; existing posts can have their own setting. Turning the default off does not establish that every older article is closed. WordPress explains that distinction in its comment-spam guide.

For a particular article, open its editor, inspect Discussion and choose the appropriate open or closed state, then save. WordPress’s post settings guide describes that panel. Check the public form afterwards, especially if a plugin supplies a replacement comment system.

Closing a thread stops new discussion through that route; it is a different decision from deleting useful approved replies. For a fictional repair tutorial, you might leave current troubleshooting articles open while closing a dated promotion whose offer has ended.

Choose the approval model you can maintain

For a small site without established commenters, holding ordinary visitor comments for manual approval is a clear starting point. Under Settings → Discussion → Before a comment appears, enable Comment must be manually approved if that matches your policy. WordPress’s moderation documentation explains the queue.

The alternative Comment author must have a previously approved comment can reduce repeated approvals, but prior approval is not a promise that the next submission is useful. Other moderation and disallowed-content checks can still apply. Do not approve generic praise merely to build a list of trusted commenters.

Requiring a name and email address does not by itself verify identity. Requiring registered login adds a different participation boundary and may deter useful contributions as well as some spam. Choose it because the site’s discussion needs accounts, not because it guarantees genuine comments.

Write a short public policy explaining relevance, promotional links, respectful discussion and review delays. “Comments are reviewed before publication” is more useful than promising instant approval when no moderator is available.

Use link thresholds as review signals

The native link-count setting holds comments at the configured threshold. Pay attention to its wording: X or more links, not merely more than X. The current comment-check reference confirms that boundary and the preceding manual-approval check.

For example, a threshold of two can hold a legitimate reader comparing two documentation sources, while a promotional submission with one link may pass that particular test. The threshold is a review rule, not an accurate definition of spam.

Choose a value based on the comments your readers actually need to submit. If every comment is already held manually, the threshold does not replace that approval requirement. Inspect plugin-specific rules too, because extensions can change classification.

Review the author website field as well as links in the text. A short, apparently relevant sentence can accompany an unrelated promotional destination. You do not need to visit a suspicious site to decide that a comment adds no value.

Keep moderation keys precise and reversible

Moderation keys can match comment content and fields such as name, website, email, IP address and browser user-agent text. Matching can occur inside longer words. WordPress documents this behaviour in the Discussion settings guide.

Suppose a fictional site adds the short key “art” to catch a repeated promotion. It could also affect a reader discussing a “starting” problem. Prefer a specific observed phrase or destination where appropriate, and check legitimate examples before expanding the list.

Keep an operating note of the key, reason and date added. Review false positives in the queue. Avoid importing a large unexplained list whose matches you cannot interpret, particularly if your articles discuss subjects that those lists treat as inherently suspicious.

Blocking an IP address also has limits: addresses can be shared or change. It is one signal, not reliable proof that every future submission from it belongs to the same person.

Distinguish moderation keys from disallowed keys

Disallowed Comment Keys are more aggressive than the ordinary moderation list. In current core, a matching ordinary submission is normally assigned to Trash when Trash is enabled, or Spam when it is not. The current approval-status routine documents this behaviour; filters can change it.

Some older instructions describe these settings inconsistently as immediate deletion or generic spam blocking. Do not assume the ordinary Pending queue will contain every match. Inspect the actual status and retention behaviour of the installed version and extensions.

The disallowed-list reference also shows matching across several fields and within text. For an uncertain new rule, holding for review is safer than automatically routing potential reader contributions out of the normal queue.

Keep the rule change small enough to reverse. A false positive should lead to inspecting the matched data and rule, not a blanket approval of everything from that name.

Close older discussions when that serves readers

Settings → Discussion can automatically close comments on articles older than a chosen number of days while leaving approved comments visible. Choose the period according to the content and moderation capacity; there is no universal number that makes every blog safer or more useful.

Consider the tradeoff for evergreen troubleshooting: an old article may still receive valuable reports about a current software change. To keep selected older threads open with native settings, turn off the global age-based closure and manage discussion per article instead. Opening an individual post does not override that global rule. The current age-based closure code shows this precedence; extensions can change behaviour. Another option is to offer a clear correction route rather than keeping those threads open.

Pingbacks and trackbacks are separate link-notification features. Review their default and per-article settings independently if the queue contains those notifications. Do not delete WordPress core files or run a broad database update just to avoid using the supported settings.

Give moderation access without unnecessary administration

Default Administrators and Editors have comment-moderation capabilities; Authors, Contributors and Subscribers do not automatically receive the same rights. Roles can be customized. See the official capability reference.

Choose an account and permission set that fits the person’s wider work. Editor still permits substantial content changes, so do not treat it as a dedicated comments-only role. If a limited moderation role is needed, have the administrator configure and verify it rather than sharing the owner’s account.

Decide who checks Pending, who reviews Spam false positives and who can change the rules. Notification emails can support that process, but a missed email should not leave the queue abandoned. Keep moderation decisions in the actual WordPress administration, using trusted access rather than unknown links in unsolicited messages.

Our roles and temporary-access guide explains the broader permission choices.