Protect your site from spam

Spam comments and form submissions are a fact of life for any public WordPress site. Here is what we recommend for blocking them on Templ.

Comment spam: use Akismet

We recommend Akismet for comment spam. It is built by Automattic (the company behind WordPress.com), filters spam in the cloud, and works out of the box with our server-side caching. Because filtering happens via an API rather than JavaScript on the page, it does not interfere with cached pages.

Step 1. In WP Admin, go to Plugins → Add New and search for "Akismet". Install and activate Akismet Anti-spam.

Step 2. Go to Settings → Akismet Anti-spam and connect your Akismet account (a free API key is available for personal sites; commercial sites need a paid plan).

Akismet now filters all incoming comments automatically.

Contact form spam: use a CAPTCHA

For spam submitted through contact forms, we recommend adding a CAPTCHA challenge:

  1. Cloudflare Turnstile - our first choice. Free, privacy-friendly, and invisible to most visitors (no puzzles to solve).
  2. Google reCAPTCHA - a solid alternative if you prefer staying within the Google ecosystem.

Both work with Elementor and all major form plugins:

  • Elementor Pro forms support reCAPTCHA natively under Form Fields, and Turnstile via a small connector plugin such as Simple CAPTCHA with Cloudflare Turnstile. Elementor Pro forms also include a built-in honeypot field, which is worth enabling regardless.
  • WPForms, Contact Form 7, and Gravity Forms all offer Turnstile and reCAPTCHA integrations.

Password reset spam

If bots submit email addresses to the Lost your password? form on wp-login.php, you or your users end up receiving password reset emails nobody asked for.

These are genuine emails sent from your site, so a high volume can hurt your sender reputation and email deliverability. They can also alarm recipients, but a reset email on its own does not mean an account was accessed - the reset link only works for someone with access to that inbox.

The fix is the same Simple CAPTCHA with Cloudflare Turnstile plugin used for signups below. After adding your Cloudflare site key and secret key, enable Turnstile on the lost/reset password form under Settings → Cloudflare Turnstile. It also covers the WooCommerce lost-password form.

Signup spam

If your site allows user registration, bots will find the signup form sooner or later.

First, check whether you need open registration at all. If you don't, disable it under Settings → General by unchecking Anyone can register.

If you do allow signups, we recommend protecting the registration form with Cloudflare Turnstile using the Simple CAPTCHA with Cloudflare Turnstile plugin (the same plugin mentioned above for Elementor forms). It adds Turnstile to:

  • The standard WordPress registration and login forms
  • WooCommerce registration, login, and checkout
  • Membership and community plugins such as BuddyPress, Ultimate Member, MemberPress, and Paid Memberships Pro

Enable Turnstile on the relevant forms under Settings → Cloudflare Turnstile after adding your site key and secret key from your Cloudflare account.

Block spam bots at the edge with Cloudflare WAF

If your site is behind Cloudflare, you can stop a lot of spam before it ever reaches WordPress by adding WAF (Web Application Firewall) rules.

This requires the site to be proxied through Cloudflare - see Configure Cloudflare to get set up. Custom WAF rules are available on Cloudflare's free plan.

Useful rules to target the endpoints spam bots hammer most:

  • Challenge comment posts. Apply a Managed Challenge to POST requests for /wp-comments-post.php.
  • Challenge login and password reset. Apply a Managed Challenge to requests for /wp-login.php, which also covers the Lost your password? form.
  • Challenge registration. If you allow signups, challenge requests to your registration URL (/wp-login.php?action=register on standard WordPress).
  • Challenge or block high-threat traffic. Use Cloudflare's threat score or bot score to challenge suspicious visitors site-wide.

If you host with our Cloudflare partnership, we can add these rules for you on request - just contact support. You can also add them yourself from Security → WAF → Custom rules in the Cloudflare dashboard.