WordPress Comment Spam Without Killing Real Replies

WordPress comment spam is the junk that lands under a post: random links and fake “nice article” lines. Real replies are the opposite job—someone asking a setup question you actually want on the page.

This page is Hold-Then-Approve. It is not WordPress.org vs WordPress.com (which product you run). It is not a staging clone walkthrough. Comments collect names and emails, so they also sit next to legal pages a new blog actually needs—privacy copy is not a spam filter.

Official WordPress.org docs: Understanding comment spam and Settings Discussion screen. Also Comments in WordPress and Comment moderation. Akismet: plugin directory.

Hold new comments for approval, keep the form open where conversation matters, and review the queue. Closing every comment form is a blunt tool, and this URL is not a security-plugin bake-off.

Table of contents

1. Why closing comments is a blunt tool
2. Hold-Then-Approve
3. Discussion settings that hold spam without killing replies
4. Akismet as a filter, not a security bake-off
5. When a real reply looks like spam
6. FAQ
7. One queue pass this week

Why closing comments is a blunt tool

Closing comments stops spam on that post. It also stops the reader who would have asked a useful follow-up. WordPress’s own spam article lists “disable comments where they are not needed” as a valid option—about pages, legal pages, thin asides—not as a default for every tutorial.

The blunt mistake is a global off switch because one post got hit. Then a new guide publishes with comments still open on old URLs, because Settings → Discussion often applies to future content only. Official FAQ wording: older posts may still accept comments until you uncheck Allow Comments on those posts.

Hold-Then-Approve

        HOLD-THEN-APPROVE
  1. OPEN     → comments only on posts that need a thread
  2. HOLD     → “Comment must be manually approved” (Discussion)
  3. FILTER   → name/email, link count, moderation keys
  4. QUEUE    → approve the real reply; leave junk in spam
  5. PRIVACY  → say what comment data you collect

WordPress documents comment moderation as one of the simplest ways to deal with spam: comments do not appear until an administrator approves them. You trade a few minutes in the queue for a live thread that is not a link farm.

Discussion settings that hold spam without killing replies

Open Settings → Discussion and match the official screen, not a YouTube overlay:

• Allow people to post comments on new articles — default for future posts
• Comment author must fill out name and email — extra friction; values are not magically verified
• Users must be registered and logged in — stronger friction; you will lose anonymous questions
• Comment must be manually approved — Hold-Then-Approve
• Hold a comment if it contains more than n links — catches link dumps; can also catch a real reply with sources
• Moderation / disallowed comment keys — words, IPs, emails, names

Nested replies and comments-per-page are display settings. They do not replace the queue. Pingbacks and trackbacks are a separate toggle; WordPress warns that turning them off in Discussion often applies to future posts unless you also clear pings on old content.

Akismet as a filter, not a security bake-off

Akismet Anti-spam is Automattic’s plugin. The official directory says it checks comments and contact-form submissions against a global spam database, and that you can review what it caught on the Comments admin screen. After activate, WordPress prompts you for an Akismet.com API key. Keys are free for personal blogs, with paid subscriptions for commercial sites—confirm on the live plugin page. This URL does not compare firewalls or login lockouts.

When a real reply looks like spam

A genuine comment can hit the queue because it includes more links than your Discussion limit, uses a word on your moderation list, comes from a new author while manual approval is on, or Akismet marked it and you have not checked Spam. WordPress documents that “every comment is in moderation” is often those rules doing their job—not a broken theme.

Approve the real ones. Raise the link threshold a notch if teachers keep pasting sources. If you test a new Discussion combination, use staging so a bad plugin setting does not take the live form down.

FAQ

How do I reduce WordPress comment spam without closing comments?

Hold comments for approval in Settings → Discussion, then approve real replies from the Comments screen. WordPress documents this as one of the simplest ways to stop spam from publishing live. Closing comments is a separate choice for posts that do not need discussion.

Where are WordPress Discussion settings?

In the admin: Settings → Discussion. WordPress.org documents that screen for allowing comments, pingbacks and trackbacks, name and email requirements, and moderation queues. Confirm labels on your version—the docs win when a checkbox name moves.

Does turning comments off in Discussion close old posts?

WordPress’s comment-spam documentation says disabling comments in Settings → Discussion usually applies only to future content. Older posts may still accept comments until you uncheck Allow Comments on those posts. If spam keeps landing on a 2019 tutorial, check that post, not only the global toggle.

What is Hold-Then-Approve?

It is a moderation habit: comments wait in a queue until you publish the ones that are actually a reply. You keep the conversation instead of letting a link dump go live. It is slower than auto-publish and faster than deleting the comment form sitewide.

Is Akismet a security plugin bake-off?

Akismet is Automattic’s anti-spam plugin for comments and contact forms. It is not a firewall, malware scanner, or login-hardening suite. Use the official WordPress.org plugin page for current features and key rules. This article does not rank security plugins.

Will a link limit block real comments?

WordPress lets you hold comments that contain more than a set number of links because many spam comments are link-heavy. Official docs also warn that legitimate comments with several URLs can hit the same queue. Raise the limit or approve those by hand instead of banning links entirely.

Do comments affect privacy pages?

Comments often collect a name, email, and message. That is personal data. Your privacy policy should describe what you collect; legal pages are a different owner than this moderation workflow.

One queue pass this week

Turn on manual approval if comments are still auto-live. Open Comments, approve one real question, and leave the link dumps in spam. If an old post is still a magnet, close comments on that URL only.