Best Wordpress Comment Spam Solution?

If your site is fairly targeted to say, English speakers, I recommend outright blocking spam countries in .htaccess (or in Apache configuration if you have access). You use RewriteRules based on %{REMOTE_HOST}, it's good enough (doesn't block if it can't look up a hostname) for most situations. Feel free to PM me for specific examples.

For some, this is too aggressive. You can use a front-end security service - traffic goes to them and gets filtered before it gets to your site. One service is CloudFlare - if you decide to go with this, go to "Threat Control" from the site dashboard and scroll to "Custom Block List" - Countries you enter (use the autocomplete) will be "challenged" - if it is detected to be a bot, it will get a separate captcha before ever hitting your site / server. This will also reduce resource usage of the server / user account.

If you do not want to block countries at all, check out the Spam Free settings, and do things like adding blocked email domains from registering. Also install the plugins listed below.

NOTE: I recommend the following plugins be installed on just about every single WP site you launch:

Stop Spammer Registrations
Ban Hammer
User Spam Remover
Limit Login Attempts (Set lockout time to 99999)
Better reCaptcha (NOT original recaptcha, as it doesn't work as well now)

Spam Free Wordpress

Other more advanced plugins, or those requiring manual steps:

Spammer Blocker

Your comment form should never be displayed on or passed data from other sites, so block it in .htaccess:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-comments-post\.php*
RewriteCond %{HTTP_REFERER} !.*PUTYOURSITEHERE.COM.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) - [F,L]
</IfModule>

Note: you should be able to copy that code and replace ONLY the PUTYOURSITEHERE.COM (leave the .*) with your actual domain (just the domain, not the site or page) and it should work.

This blocks two common identifiers of automated spam:

- Requests without a "User-Agent" which identifies the browser or legitimate program
- Requests to POST to the comment form (make a comment) that did NOT come from your site

Human comments are pretty tough to stop, moderation is really the best for that, or just be sure to remove them. You may also consider stopping comments on posts after a certain time if you do not already do so.

Feel free to PM if you're still having trouble after all of that ^

Best of luck!

Peter

The best comment spam solution is scrapebox.

The best anti-comment spam solution is akismet.