Some links on this page are affiliate links. If you buy through them, we may earn a commission at no extra cost to you.
If your WordPress site accepts comments, lets people register, or runs a forum, spammers will eventually find it. This guide is for bloggers, small business owners and agency teams who want to keep user-generated spam from piling up and from damaging how the site appears in Google Search. It walks through the built-in WordPress settings first, then the link attributes Google recommends, then how to watch for trouble. It does not cover contact forms, which have their own problems; see our guide to stopping contact form spam in WordPress.
Contents
What user-generated spam is and why Google cares
Google’s Search Central guidance on preventing user-generated spam explains that spammers abuse open comment forms and other places where visitors can publish content, and that spammers are often after a backlink. The same page describes spammy profiles and accounts, and suspicious usernames or other values submitted at signup. WordPress.org’s documentation adds that comment spam often looks like irrelevant messages, suspicious links, repeated keywords or generic comments posted to promote another site, and that much of it is posted in bulk by bots rather than aimed at your site personally.
Google recommends monitoring Search Console for manual actions and security issues. For wider context on spam enforcement, see our checklist on Google’s September 2026 spam update.
Enjoying this? Get our best tips by email
Practical SEO, link building and content strategies, straight to your inbox.
Step 1: Tighten Settings → Discussion
In the WordPress dashboard, go to Settings → Discussion. The WordPress.org documentation for this screen lists the options below. Work through them and click Save Changes when finished.
Require some effort from commenters
- Comment author must fill out name and email: WordPress.org describes this as a way to make spammers do a little extra work, but notes the details are not verified, so it is a speed bump rather than a wall.
- Users must be registered and logged in to comment: only logged-in registered users can comment. This is stronger, but it also shrinks your genuine comment volume and ties into your registration settings, covered below.
Choose what gets held before it appears
Under Before a comment appears, An administrator must always approve the comment holds every comment, while Comment author must have a previously approved comment lets returning commenters through. For a small blog, approving everything is the safest start. WordPress.org’s comment moderation page calls moderation useful for dealing with comment spam, and Google’s guidance says manual approval adds workload but is effective.
Use the Comment Moderation list
The Comment Moderation section lets you hold comments that contain a set number of links. WordPress.org observes that spammers moved from many links to only one or two, so choose a number that fits your audience; the documentation suggests looking at your own comments to decide. A text box below it takes words or IP addresses, one per line, which hold a comment for review when they appear in the comment’s content, name, URL, email, IP or browser user-agent string. The documentation warns that matching happens inside words, so the entry “press” would also match “WordPress”. Keep entries specific.
Be careful with Disallowed Comment Keys
The Disallowed Comment Keys box works like the moderation list, except that matching comments are removed without warning. The WordPress.org moderation page says genuine comments can be deleted without you ever knowing, and the Discussion screen page suggests treating it as a last resort. Use it only for terms you are certain no real visitor would write, and prefer the moderation list when in doubt. (Older WordPress documentation calls this box the Comment Blocklist, and before version 5.4 it was named “Comment Blacklist”.)
Step 2: Close comments on old posts
Spammers often target older posts that nobody is watching. In Settings → Discussion, tick Automatically close comments on articles older than [X] days and enter a number of days. WordPress.org says the comment form is then disabled on posts older than that, while previously approved comments stay visible.
You can also close comments on individual posts or in bulk. For a single post, open it in the editor and set Discussion to closed. For several posts, go to Posts, select them, choose Edit from the Bulk actions dropdown, click Apply, set Comments to “Do not allow”, then click Update. WordPress.org also notes that turning off comments in Settings → Discussion generally applies only to future content, so posts that already exist need to be updated separately.
Step 3: Review registration settings
Spammy profiles and fake accounts come from open registration. Go to Settings → General and look at Membership. The checkbox Anyone can register lets anyone create an account. If you do not need public accounts, leave it unticked; this removes a whole category of spam.
If you do need registration, check New User Default Role on the same screen. WordPress.org lists Administrator, Editor, Author, Contributor and Subscriber as the choices. Give new accounts the lowest role that does the job, normally Subscriber, so a fake account cannot publish anything.
Google’s guidance goes further for sites with public profiles or posts from new members. It suggests logging signups and looking for patterns such as unusually fast form completion, many requests from the same IP range, odd user agents and suspicious usernames. It also suggests applying a noindex robots meta tag to posts from new users who have no reputation yet, and allowing indexing once their reputation grows, and using reCAPTCHA or similar verification in signup forms. On WordPress, most of this needs a plugin or custom code, which brings us to the next step.
Step 4: Understand rel=”ugc” and nofollow
Google’s page on qualifying outbound links says to use rel="ugc" for user-generated content links such as comments and forum posts, rel="sponsored" for advertisements and paid placements, and rel="nofollow" when the other values do not apply. Values can be combined, for example rel="ugc nofollow". Google also says you can remove the attribute for trusted members who have contributed high-quality content over time.
For comments, WordPress already does the work. The WordPress core team’s post on the change states that, starting with WordPress 5.3, links in comments and comment author URLs use rel="nofollow ugc" by default. So on a current install, a spammer’s link in an approved comment is already flagged. The spam still clutters your pages, which is why moderation matters. Forum plugins and profile pages may not apply the same attributes, so check the source of a published page to see what your setup outputs.
Step 5: Add an anti-spam layer
Built-in settings catch a lot, but bots are persistent. Google’s guidance mentions that for WordPress, plugins can help maintain a blocklist, and that CAPTCHA-style verification can keep scripts from creating accounts. WordPress.org points to the anti-spam category of its plugin directory and says there is no single best plugin, since spammers use different tactics. It suggests judging a plugin by how recently it was updated, whether it is compatible with your WordPress version, and whether the author offers clear documentation and support.
In generic terms, the useful types are:
| Type of tool | What it does | Trade-off |
|---|---|---|
| Comment filtering service or plugin | Checks comments against known spam patterns before they reach the queue | May send comment data to an outside service; check its privacy terms |
| CAPTCHA or human verification | Stops scripts on comment and signup forms | Adds friction for real visitors |
| Registration anti-spam | Screens or limits new accounts | Needs tuning to avoid blocking genuine members |
| Firewall or IP deny list | Blocks repeat offenders by address | Needs upkeep; shared IPs can catch innocent users |
Keep WordPress and plugins updated, as WordPress.org advises.
Step 6: Monitor with Google Search Console
Google recommends verifying your site in Search Console so you receive alerts about manual actions and security issues. Beyond alerts, Google suggests regularly checking the Page Indexing and Search performance reports for unexpected spikes in indexed pages, impressions or queries unrelated to your site’s purpose. Our guide to the Search Console Performance report shows how to read that data.
Google also lists signals to watch: redirects you did not add, spammy keywords, excess ad sections, large blocks of encoded JavaScript and sudden traffic spikes in server logs. A simple routine is to review the moderation queue weekly and check Manual actions and Security issues in Search Console monthly.
Key takeaways
- Use Settings → Discussion to require approval, limit links and keep moderation lists specific.
- Close comments on old posts and untick “Anyone can register” unless you need accounts.
- WordPress adds rel=”nofollow ugc” to comment links by default since version 5.3, but forum and profile plugins may differ.
- Add one well-maintained anti-spam layer and watch Search Console for manual actions and security issues.
FAQ
Does nofollow stop comment spam from hurting my site?
It reduces the value of the link to the spammer, which is why spammers want backlinks, but it does not remove the spam from your pages. Moderation is still needed.
Should I just turn comments off?
WordPress.org says that if a page or post does not need comments, turning them off can be a simple way to avoid spam. If discussion helps your readers, keep comments open on recent posts with moderation on.
How will I know if Google has penalised my site for spam?
Verify your site in Search Console. Google says that is how you receive alerts about manual actions and security issues, which you can also review in those reports.
Sources
- Preventing user-generated spam (Google Search Central)
- Qualify your outbound links to Google (Google Search Central)
- Settings Discussion screen (WordPress.org Documentation)
- Comment moderation (WordPress.org Documentation)
- Understanding comment spam (WordPress.org Documentation)
- Settings General screen (WordPress.org Documentation)
- WP 5.3 introduces new functions to add UGC attribute to links, and implements it to comments (Make WordPress Core)
