WordPress Anti-Spam Plugin: 7 Picks, 3 to Skip
The right WordPress anti-spam plugin is the one that matches the spam you are actually getting, and for a commercial site with more than one kind of it that is Anti-Spam by CleanTalk at $12 a year — the only option here that covers comments, registrations, contact forms and WooCommerce orders under one licence with no ceiling on how many checks it runs. If the spam is only blog comments, Antispam Bee does that free forever on a commercial site and sends nothing to anyone. And if you assumed Akismet was the free default: its Personal plan is for non-commercial sites only, and the cheapest plan that covers a commercial site is $119.40 a year for about sixteen spam checks a day.
Jump to: which spam you have · which one fits you · the comparison · what they cost · CAPTCHA or not · the seven plugins · what to skip · the verdict · questions
Which kind of spam are you actually getting?
Anti-spam is an unusual category. The free options are genuinely good, the paid ones are genuinely cheap, and almost every plugin on every roundup will stop ordinary blog comment spam. So “which is best” is the wrong question. There are four different problems here, and a plugin that solves one may not touch another.
- Comment spam. Links posted to the native WordPress comment form. The easiest problem, and the one with the most free answers.
- Registration spam. Bot accounts created through wp-login.php. A comment filter will not see these at all.
- Contact-form spam. Submissions through Contact Form 7, WPForms, Gravity Forms, Elementor and the rest. These forms do not pass through WordPress comment hooks, so a comments-only plugin is blind to them.
- WooCommerce spam. Fake orders, junk account registrations and card-testing attempts at checkout. The narrowest coverage of the four, and the place where free tiers tend to stop.
Antispam Bee states the point plainly on its own listing: it “works best with default WordPress comments”, and “does not help to protect form plugins and does not prevent spam registrations”. That is not a flaw, it is a scope. The mistake is installing it for contact-form spam and concluding that anti-spam plugins do not work.
The second question is the one every reader is really deciding: whether to put a puzzle in front of a visitor. That trade changes the answer more than any feature list does.
Which WordPress anti-spam plugin fits your site?
Three inputs decide almost every case: what is being spammed, whether the site is commercial (which decides whether Akismet’s free plan is even permitted), and whether you will show visitors a challenge. Set them and the answer narrows to one named plugin.
Antispam Beefree
Free forever, commercial projects included · 700,000+ active installs · 4.8 / 5 from 226 reviews
For comment spam on a site that earns money, Antispam Bee is the answer that costs nothing and stays honest about it: its listing says it is “free forever, for both private and commercial projects”, where Akismet’s free plan is not. It filters natively, keeps no private user data and sends no comment text to an outside service. Its limit is its scope — comments and trackbacks only, so it will not touch your contact form or your registration page.
Install counts, ratings and free-tier terms read from each plugin’s WordPress.org listing, and prices from each vendor’s pricing page, on 12 September 2026.
How the seven compare
| Plugin | Stops spam in | Shows a challenge | Free tier boundary | Paid from | Installs · rating | Best for |
|---|---|---|---|---|---|---|
| Anti-Spam by CleanTalk | Comments, registrations, forms, WooCommerce, bookings, search | No | Trial only, then paid | $12 a year, 1 site | 200,000+ · 4.8 (3,211) | More than one kind of spam at once |
| Akismet | Comments, supported forms | No | Non-commercial sites only | $119.40 a year, 1 site | 5 million+ · 4.7 (1,186) | Personal blogs |
| Antispam Bee | Comments and trackbacks only | No | None — free for commercial use too | No paid tier | 700,000+ · 4.8 (226) | Comment spam on a commercial site |
| WP Armour | Comments, registration, most form builders | No, hidden honeypot | WooCommerce checkout and logging are paid | Extended tier | 400,000+ · 5.0 (1,440) | Form spam with nothing sent anywhere |
| Cloudflare Turnstile plugin | Login, registration, comments, forms, WooCommerce checkout | Yes, usually without a puzzle | 20 widgets, unlimited challenges | No paid tier | 200,000+ · 4.7 (256) | Free coverage of WooCommerce screens |
| Dam Spam | Registrations, logins, comments | Optional | None | No paid tier | 3,000+ · 4.3 (4) | Blocklist-driven registration spam |
| OOPSpam | Forms and comments | No | 40 spam checks a month | $230.04 a year | 6,000+ · 4.9 (49) | High-volume forms with a paid contract |
Versions, install counts, ratings and free-tier terms read from each plugin’s WordPress.org listing on 12 September 2026; prices from each vendor’s own pricing page the same day.
What does a WordPress anti-spam plugin actually cost?
Every roundup says Akismet is free and CleanTalk is cheap. Neither statement survives contact with a commercial site, so here is the arithmetic, worked from the published plans rather than the marketing line. All figures are annual, for a commercial site, at one, three and ten sites.
| Option | 1 site | 3 sites | 10 sites | Checks allowed a month |
|---|---|---|---|---|
| Antispam Bee, WP Armour, Turnstile, Dam Spam | $0 | $0 | $0 | No ceiling |
| Anti-Spam by CleanTalk | $12.00 | $24.00 | $69.00 | No ceiling |
| Akismet Pro | $119.40 | $358.20 | Not available, Pro stops at 4 sites | 500 per site tier |
| Akismet Business | $599.40 | $599.40 | $599.40 | 5,000 in total |
| OOPSpam Starter | $230.04 | $230.04 | $230.04 | 25,000 |
Annual figures computed from the monthly billed-yearly prices on each vendor’s pricing page, read 12 September 2026. Akismet Pro at three sites is the $29.85 tier; Business is $49.95 a month billed yearly.
The number that decides this category is the one nobody prints: Akismet’s cheapest commercial plan buys about sixteen spam checks a day. Five hundred a month sounds generous until you divide it. A modest blog that attracts 30 spam comments a day exhausts a $119.40 plan inside the first three weeks of the month. Even Business, at $599.40 a year, allows 5,000 checks a month across every site you own — about 164 a day in total. CleanTalk’s $12 licence has no such number attached to it at all.
Put the same plans on a per-check basis and the gap is not subtle. At its own ceiling Akismet Pro works out at $19.90 per thousand spam checks and Business at $9.99. OOPSpam Starter, which buys 25,000 checks a month, comes to $0.77. CleanTalk running 60,000 checks in a year on a single site costs $0.20 per thousand. Across ten commercial sites the comparison is $599.40 against $69.00 — Akismet Business costs nearly nine times what CleanTalk does, and caps your checks where CleanTalk does not.
None of which makes the free plugins wrong: if your spam is only comments, Antispam Bee handles it for nothing on a commercial site, and no arithmetic beats zero. The table matters at the point where spam spreads across forms, registrations and orders, because that is when people reach for a paid filter and reach for the wrong one.
WPNeon runs Anti-Spam by CleanTalk 6.87 on this site and does not run Akismet. The licence terms above are the reason.
Should you show a CAPTCHA or not?
This is the real trade in the category, and every plugin here sits on one side of it.
A challenge costs conversions. Turnstile, hCaptcha and reCAPTCHA all put something between a visitor and the submit button. Turnstile usually resolves without a puzzle, which makes it the mildest of the three, but every extra step loses some proportion of genuine submissions. That loss never appears in a plugin’s statistics — only the blocked spam does, which is why challenge-based plugins always look like they are working.
A cloud filter costs privacy. Akismet, CleanTalk and OOPSpam score submissions on their own servers, which means comment text, email addresses and IP addresses leave your site. That is the mechanism, not a side effect. If you operate under a policy that forbids sending visitor data to a third party, those three are out regardless of price.
A honeypot costs neither, and catches less. WP Armour and Antispam Bee work inside your own install. Nothing is shown and nothing is sent. The limit is that a hidden field only defeats a bot that fills in hidden fields; a bot driving a real browser walks past it, where a cloud filter would have scored the submission on its content and reputation.
Most sites should start on the honeypot side, because it is free and invisible, and move to a cloud filter or a challenge only when something is demonstrably getting through. Starting with a CAPTCHA on every form is the common mistake, and it is paid for in submissions you never see.
The seven WordPress anti-spam plugins worth installing
Anti-Spam by CleanTalk
For a site with more than one kind of spam, this is the pick. Version 6.87, updated in September 2026, 200,000+ active installs, 4.8 out of 5 from 3,211 reviews, tested to WordPress 7.1, requires PHP 7.2.
The capability that decides it is breadth under one licence: the listing covers comments, registrations and logins, contact forms, fake eCommerce orders, bookings, subscriptions, surveys and polls, WooCommerce and search forms, with no cap on checks on any plan. At $12 a year for one site and $69 for ten, it is cheaper than the paid tier of most single-purpose plugins. Nothing is shown to a visitor.
The honest limitation is structural: it is Software-as-a-Service, and the plugin has to reach cleantalk.org to score anything. Every submission leaves your server, and if the service is unreachable your forms fall back rather than filter. That is the trade you accept for the coverage.
WPNeon runs this plugin on wpneon.com.
Anti-Spam by CleanTalk Affiliate link · CleanTalk on WordPress.org
Akismet Anti-spam
The right answer for a personal blog and an expensive one for anything else. Version 5.7.2, updated in August 2026, 5 million+ active installs, 4.7 out of 5 from 1,186 reviews, tested to WordPress 7.1, requires PHP 7.2.
What decides it is the licence, not the filtering. Akismet’s own documentation states the condition in one line: “Non-commercial sites only. If any of your sites are commercial, upgrade to Pro, Business, or Enterprise.” On a genuinely personal site the Personal plan is pay-what-you-can with no monthly check limit, which is the best deal in this article. On a site with a single affiliate link or an ad unit, it is not available, and the cheapest plan that covers you is $119.40 a year with 500 checks a month.
The limitation beyond price is the ceiling itself. Paid plans meter spam checks, so a spike in attacks is a billing problem as well as a spam problem — the opposite of what you want from a filter.
Antispam Bee
For comment spam on a commercial site, nothing beats free. Version 2.11.13, updated in August 2026, 700,000+ active installs, 4.8 out of 5 from 226 reviews, tested to WordPress 7.1.
The capability that decides it is the licence again, in the other direction: the plugin’s FAQ answers the paid-tier question with “Antispam Bee is free forever, for both private and commercial projects.” It filters locally, states that it does not save private user data, and needs no account, no key and no outside service. For a business blog whose only spam problem is the comment form, this is the whole answer.
The limitation is scope, and the listing is refreshingly direct about it: it “does not help to protect form plugins and does not prevent spam registrations”. Install it for contact-form spam and it will do nothing at all.
WP Armour – Honeypot Anti Spam
The best free option for form spam, and the best-rated plugin on this page. Version 2.4.02, updated in September 2026, 400,000+ active installs, 5.0 out of 5 from 1,440 reviews, tested to WordPress 7.1.
The capability that decides it is the free coverage list: comments and registration plus Contact Form 7, Gravity Forms, WPForms, Formidable, Caldera, Toolset, Elementor Forms, Fluent Forms, Divi’s contact form and Theme My Login, with the listing stating there are no API calls, subscriptions, captcha or puzzle. A hidden field is added, bots fill it, humans never see it.
Two limitations matter. WooCommerce checkout, spam logging and IP blocking are in the paid Extended tier, not the free one. And the honeypot is JavaScript-based, so a bot that renders pages properly can step over it where a content filter would have caught it.
Simple CAPTCHA with Cloudflare Turnstile
The free route for anyone who will accept a challenge, including on WooCommerce. Version 1.43.0, updated in September 2026, 200,000+ active installs, 4.7 out of 5 from 256 reviews, tested to WordPress 7.1.
The capability that decides it is reach for nothing: WordPress login, registration, password reset and comments, WooCommerce checkout, account details and login, plus WPForms, Fluent Forms, Contact Form 7, Gravity Forms, Formidable, Forminator, Jetpack, Kadence, SureForms, Elementor Pro, Easy Digital Downloads and Paid Memberships Pro. The plugin describes itself as free with no paid version and no added tracking, and Cloudflare’s free Turnstile plan allows up to 20 widgets with unlimited challenges.
The limitation is the one every challenge carries. Turnstile usually passes a visitor without a puzzle, but it is still a third-party script in the submission path and it will cost you some completed forms. Put it on the forms that are being attacked, not on all of them.
Simple CAPTCHA with Cloudflare Turnstile on WordPress.org
Dam Spam
For registration spam you want to fight with blocklists rather than filtering. Version 1.1.8, updated in September 2026, 3,000+ active installs, 4.3 out of 5 from 4 reviews, tested to WordPress 7.1, free with no paid tier.
The capability that decides it is inherited: the listing states that “Dam Spam is a fork of Stop Spammers”, the long-running registration blocker, rebuilt as its maintained successor with settings that migrate across automatically. That means IP and country blocking, email and domain filtering, and checks against external reputation services such as Stop Forum Spam, aimed squarely at bot account creation rather than comment text.
The limitation is its youth as a listing: 3,000+ installs and four reviews is a thin evidence base next to the plugins above, and blocklist-driven blocking is the approach most likely to catch a real person who shares an address with a bad neighbour.
OOPSpam Anti-Spam
The paid, no-challenge option for high form volume. Version 1.2.78, updated in September 2026, 6,000+ active installs, 4.9 out of 5 from 49 reviews, tested to WordPress 7.1 — the highest rating of the paid options here.
The capability that decides it is headroom: the Starter plan carries 25,000 API calls a month at $19.17 a month billed annually, where Akismet Business allows 5,000 for more than twice the money. For a site running heavy form traffic that cannot show a CAPTCHA, that ratio is the argument.
The limitation is the entry point. The free allowance is 40 spam checks a month, which is a demonstration rather than a tier, and $230.04 a year is nineteen times CleanTalk’s single-site price for narrower coverage. At 6,000 installs it also has the smallest deployed base on this page.
Also checked, not picked. Titan Anti-spam & Security 7.5.2 is maintained and current — updated in August 2026, 50,000+ installs, tested to WordPress 7.1 — but it is a security suite with a spam filter attached, bundling a firewall, malware scanner and two-factor login, and 43 of its 370 reviews are one-star. If you want that bundle, choose it as a security plugin rather than an anti-spam one and compare it against the field on our WordPress security plugins page.
Which anti-spam plugins should you skip?
Three plugins that still appear on anti-spam lists are closed on WordPress.org, which means they cannot be installed or updated from your dashboard at all. A closed listing is not a slow release cycle; it is a plugin you cannot get.
| Plugin | Status | Closed on | Stated reason |
|---|---|---|---|
| WP Cerber Security | Closed | 22 September 2022 | Security Issue |
| Captcha Bank | Closed | 2 October 2024 | Security Issue |
| WPBruiser | Closed | 23 July 2026 | Temporary, pending a full review |
Closure notices read from each plugin’s WordPress.org listing on 12 September 2026.
Three more are still installable but have fallen behind the platform, which matters in a category whose whole job is to keep up with attackers.
- Zero Spam for WordPress 5.5.8 was updated in March 2026 and is tested only to WordPress 6.9.7, two releases behind the plugins above. 20,000+ installs, 4.1 from 143 reviews.
- Spam Destroyer 2.1.7 was updated in April 2026 and is tested to 7.0.4. 5,000+ installs, 4.6 from 54 reviews.
- Stop Spammers Classic 2026.6 is tested to 7.0.4 and its own listing says it “is legacy code that will receive security patches only moving forward”. Its author points users to Dam Spam, which is why the successor rather than the original is in the list above.
Counted together, six of the thirteen anti-spam plugins checked for this page are either closed or tested only against a WordPress release older than 7.1. That is close to half the field, and it is the single strongest argument for checking a listing yourself before installing anything a roundup recommends.
Which WordPress anti-spam plugin should you choose?
For most commercial sites with spam in more than one place, Anti-Spam by CleanTalk. One $12 licence covers comments, registrations, forms and WooCommerce with no check ceiling, and nothing is shown to a visitor.
If your only problem is blog comments, Antispam Bee, and pay nothing. It is free forever on commercial projects, filters locally and sends no data anywhere — the best value on this page by a distance.
If your only problem is contact forms, try WP Armour before you buy anything. Its free version already covers the major form builders with a hidden honeypot, and it is rated 5.0 from 1,440 reviews. Check your form plugin first, though: WPForms enables its own anti-spam protection by default in the free version.
Skip Akismet unless the site is genuinely non-commercial. Its free plan is restricted to non-commercial sites, and the cheapest plan that covers a business site is $119.40 a year for about sixteen checks a day. Skip WP Cerber, Captcha Bank and WPBruiser entirely — all three are closed on WordPress.org.
Once you have chosen
CleanTalk review — what the $12 plan does and does not catch, and how the false-positive complaints hold up before you put it on a live checkout.
Akismet alternatives — the move if you are already on Akismet and have just discovered your site counts as commercial.
Contact form plugins — worth reading before adding a dedicated filter, because your form plugin may already ship the protection you are about to install.
Comment plugins — if comment spam is bad enough that you are considering moving comments off WordPress entirely.
Frequently asked questions
What is the best anti-spam plugin for WordPress?
For a commercial site with spam in more than one place, Anti-Spam by CleanTalk at $12 a year, because it is the only option that covers comments, registrations, contact forms and WooCommerce orders under a single licence with no limit on checks. If the spam is only blog comments, Antispam Bee does that free on commercial sites too. For contact forms alone, WP Armour’s free honeypot is enough for most sites.
Is Akismet free?
Only for non-commercial sites. Akismet’s documentation states: “Non-commercial sites only. If any of your sites are commercial, upgrade to Pro, Business, or Enterprise.” Ads, affiliate links or selling anything make a site commercial. The cheapest plan that covers a commercial site is $9.95 a month billed yearly, which is $119.40 a year, and it allows 500 spam checks a month, roughly sixteen a day.
What are the best free WordPress anti-spam plugins?
Antispam Bee for comments, free forever including commercial projects. WP Armour for contact forms and registration, using a hidden honeypot with no account and no API calls. Simple CAPTCHA with Cloudflare Turnstile if you will accept a challenge, which is the only free option covering the WooCommerce checkout. Dam Spam for blocklist-based registration blocking. All four cost nothing at any number of sites.
How do I stop spam comments on WordPress without a plugin?
WordPress has built-in settings that remove much of the problem. Require a name and email address on comments, hold every first-time comment for approval, and close comments automatically on posts older than a set number of days. Disabling trackbacks and pingbacks removes another common route. These reduce spam that reaches you but do not stop bots submitting, so a filter still helps on a busy site.
Do I need an anti-spam plugin if my contact form already has one?
Often not. WPForms documents that its modern anti-spam protection is toggled on by default, and that its Akismet, reCAPTCHA, hCaptcha and Turnstile integrations work in the free Lite version. If contact forms are your only spam problem and that setting is on, adding a dedicated plugin duplicates the work. A separate filter earns its place when comments, registrations or WooCommerce orders are also being hit.
@
Thank you very much for this helpful round-up. I just finished installing WordPress on my site. I was researching the best anti-spam plugin to use. I already installed Jetpack but I think adding Google reCaptcha is also make my site site more secure against spam bots. What do you think?
@
Jetpack along with Akismet should work pretty well to remove 99% of the spam. But if you still receive lot of spam queries, surely Google re-captcha can be added to stop comments spam. This very blog (wpneon.com) works with only Jetpack & Akismet.