10 Best Anti-Spam Plugins for WordPress

Most anti-spam plugins for WordPress get picked in about thirty seconds: you activate whatever shipped with the install and move on. Then a client’s contact form starts producing forty fake leads a day, or Akismet suspends the free key because the site runs ads. This is a comparison of what these tools actually cost, what their licenses actually allow, and how much of the job WordPress already does for nothing. Prices checked August 2026.

Anti-spam plugins compared on price

Tool	Free tier	Paid entry price	Renewal	Best for
Akismet	Personal plan, non-commercial sites only	Pro ₹578.95/mo billed yearly (₹6,947.40/yr), 500 checks, 1 site	No intro discount shown	Comment-heavy blogs that qualify as personal
Antispam Bee	Free, commercial use allowed	None	None	EU sites that want no third-party lookups
CleanTalk	Trial only	$12/yr, 1 site ($69/yr for 10)	No separate renewal price published	Registration and form spam at volume
Simple CAPTCHA with Cloudflare Turnstile	Free plugin; Turnstile free for up to 20 widgets	Turnstile Enterprise: contact sales	Not published	Stopping form bots before they submit
Titan Anti-spam & Security	Free	Pro exists; no price on a reachable vendor page at the check date	Not published	Small sites wanting spam plus login hardening
Zero Spam for WordPress	Free	None advertised	None	Sites that refuse to show a challenge
Stop Spammers Classic	Free	None	None	Existing installs only
All-In-One Security (AIOS)	Free	Premium $44.50 first year, 2 sites	Renews at $89.00 / year	Sites that also want a firewall
Gravity Forms	None	Basic $59/yr, 1 site	No separate renewal price published	Form spam on a forms-heavy site
Jetpack	Free plugin; spam filtering is paid	Security ₹584.95/mo billed yearly for the first year (₹7,019.40)	Renews at ₹1,171.95/mo (₹14,063.40/yr)	Sites already paying for Jetpack

Start here: what WordPress already gives you for free

Before you install anything, open Settings > Discussion. WordPress ships with a set of comment controls that cost nothing, run no external lookups and never expire. The documented options that actually matter are these four.

• Comment author must have a previously approved comment. First-time commenters queue for moderation. This single checkbox stops almost all drive-by bot comments from ever appearing publicly.
• Hold a comment in the queue if it contains 2 or more links. The default is 2, and most people never look at it. Spam is a link delivery mechanism; the threshold is the cheapest filter you own.
• Automatically close comments on articles older than X days. Old archive posts are where scripted spam lands, because it targets the sitemap rather than your homepage. Sixty days removes most of the target surface.
• Comment Blocklist. Words, URLs or IPs listed here mark a comment as spam outright. Use it sparingly, because matches are deleted rather than queued and genuine comments can go with them.

What this does not cover is user registration, contact forms, WooCommerce account signups and login attempts. That is the gap a plugin fills, and it is worth knowing which gap you actually have before you pay for anything. If your traffic is mostly hitting wp-login.php rather than your comment form, you want brute force protection plugins instead.

The best anti-spam plugins for WordPress in 2026

Ten tools, in the order we would consider them. Two of them are not comment filters at all, and they are in the list because comment spam and form spam are separate problems that get solved by separate things. Each entry gets the same four lines: what it does, what it costs, who it suits, and when to walk away.

1. Akismet

Akismet is the default. Its WordPress.org listing shows 5,000,000+ active installs, more than anything else in this list. It is a cloud filter: each comment is posted to Akismet’s API, scored against a shared corpus, and returned as ham or spam. It works well and it is genuinely low-effort.

The licensing is where people get caught. Akismet’s own guidance on free versus paid keys lists what a free Personal key does not cover: ad code such as AdSense, affiliate links, live chat plugins, promoting a business or service, accepting donations, running on e-commerce platforms, or using a domain recognized as commercial. Noncompliance, it says, results in immediate suspension of services without notice. If you have ever read about how to monetize a WordPress blog and then acted on it, you are on the commercial side of that line.

Key features: cloud-based comment and form spam scoring, a spam queue in wp-admin with per-comment reasons, form integrations for Contact Form 7, Gravity Forms, WPForms and others, and a discard option that drops the worst spam without storing it.

Price: Personal is pay-what-you-can and non-commercial only. Pro starts at ₹578.95 per month billed yearly on the Akismet pricing page, which is ₹6,947.40 a year for 500 checks a month on one site, rising to ₹2,315.80 a month (₹27,789.60 a year) for 2,000 checks across four sites. Business is ₹2,906.95 a month billed yearly, or ₹34,883.40 a year, for 5,000 checks on unlimited sites — the most expensive Akismet tier with a published price. That page localizes currency, so your own total may be shown in something else entirely.

Best for: a personal blog with a busy comment section, or a commercial site whose owner would rather pay than think about spam again. Note the ceilings: Akismet’s API usage limits are unlimited on Personal but capped at 500 to 2,000 calls a month on Pro and 5,000 on Business, and three consecutive months over the cap means further calls get denied.

Skip it if: you run a small commercial site with heavy form traffic. 500 checks a month sounds generous until a bot finds your contact form on a Tuesday.

2. Antispam Bee

Antispam Bee is the answer to the Akismet licensing problem. It is free, it stays free, and its WordPress.org listing says so plainly: free forever, for both private and commercial projects, on as many sites as you want. 700,000+ active installs, 4.8 stars, updated within the last week at the check date.

The mechanism is different from Akismet’s. Instead of posting every comment to a central service, it runs a stack of local heuristics and only reaches outward for the checks you switch on. That is the honest version of its no-personal-data-to-third-parties claim: true by default, and the country check uses an external lookup service if you enable it.

Key features: regular expression matching, treating BBCode links as spam, trusting commenters who have a Gravatar, restricting comments to a chosen language, allowing or blocking commenters by country, and a local database of previously flagged spammers.

Price: free, no paid tier, no service subscription.

Best for: commercial blogs on a zero budget, and any site where sending commenter data offshore is a problem. It is developed in Europe and its FAQ makes a GDPR compliance claim, which matters if you are already working through GDPR compliance plugins for the rest of the site.

Skip it if: you need form and registration protection. Antispam Bee is a comment and trackback filter. It does not guard your signup flow.

3. CleanTalk

CleanTalk is the one we reach for on client work. The plugin is GPL and free; the cloud service behind it is $12 a year for a single site on CleanTalk’s pricing page, and its plugin listing sums the model up as free trial, then $12 per year. That is the cheapest of the dollar-priced paid tiers in the table above, and it buys unlimited checks rather than a monthly call allowance.

Coverage is the real argument for it. It filters comments, user registrations, contact forms, WooCommerce checkout and order notes from one settings screen, which is exactly the spread you need on a store. If you are assembling a stack of WooCommerce plugins, this is the piece that stops the fake account registrations nobody warns you about.

Key features: no captcha shown to visitors, real-time cloud filtering, a spam log you can review and restore from, blocklist and allowlist by IP and email, and a personal spam list per account.

Price: $12/yr for 1 site, $24 for 3, $36 for 5, $69 for 10, $115 for 20, $160 for 30, $200 for 40, or $27 a month ($324 a year) for unlimited sites. At the 10-site tier that is $6.90 per site per year, which is the number that makes it work for agencies. No separate renewal price is published.

Best for: anyone maintaining more than three WordPress sites, and any site with open registration.

Skip it if: you refuse to route form submissions through a third-party service, or you want something that keeps working when the subscription lapses. It will not.

4. Simple CAPTCHA with Cloudflare Turnstile

Not a spam filter — a challenge. Turnstile is Cloudflare’s alternative to reCAPTCHA, and it usually resolves without the visitor doing anything. The WordPress plugin has 200,000+ active installs and wires it into the login, registration, lost-password, comment and popular form-plugin endpoints.

The reason it belongs in this list is that comment filters and form challenges solve different halves of the problem. A filter judges content after submission. A challenge stops the request before your database ever sees it, which is the difference between a clean comments table and a bloated one. Cloudflare’s own documentation notes it can be embedded in any website without routing traffic through Cloudflare, so your DNS can stay where it is.

Key features: invisible, managed or interactive challenge modes, integrations for WooCommerce, WPForms, Contact Form 7, Elementor forms and more, plus a failure log.

Price: the plugin is free. Cloudflare’s Turnstile plans page lists the free tier as up to 20 widgets with unlimited challenges and seven days of analytics; Enterprise is contact-sales and adds unlimited widgets, 30 days of analytics and removal of Cloudflare branding.

Best for: pairing with any comment filter. This is the one plugin here we would run alongside another. It is lighter than a full anti-spam suite on cached pages, which matters if you have spent time trying to speed up a WordPress site.

Skip it if: you have a policy against loading Cloudflare’s script on your forms, or your audience includes people on hardened browsers where challenges fail.

5. Titan Anti-spam & Security

Titan, now maintained by Themeisle, bundles spam filtering with login hardening. 50,000+ active installs and a 4.5-star average across 369 ratings on its WordPress.org listing. The free tier blocks comment spam against a global database, limits login attempts, hides author logins, disables XML-RPC and logs activity.

Price: free tier on WordPress.org. A Pro tier exists and adds machine-learning spam detection, a scan of existing comments and two-factor authentication, but Themeisle did not have a reachable pricing page for it at the check date, so we are not quoting a figure. Confirm at checkout before you commit.

Best for: a small site where you want one plugin doing spam and basic hardening. If two-factor is what you actually came for, dedicated two-factor authentication plugins will do it better and for free.

Skip it if: you already run a security plugin. Two plugins both trying to limit login attempts will lock out your own client.

6. Zero Spam for WordPress

Zero Spam takes the JavaScript approach: legitimate browsers run a small script that marks the submission as human, and most bots never run it. No challenge is ever shown. It also pulls from shared blocklists and lets you build your own.

Two caveats worth knowing before you install it. Its WordPress.org listing shows 20,000+ active installs, a 4.1-star average from 143 ratings and a last update in March 2026, which is slower than everything else here. And a JavaScript-signed submission is exactly the thing aggressive page caching can break. If you run one of the WordPress cache plugins with HTML caching on the comment form, test a real submission before you call it done.

Price: free. Best for: sites that want zero visitor friction and are willing to test. Skip it if: update cadence matters to you, or your forms are behind a full-page cache.

7. Stop Spammers Classic

Read the name carefully: the plugin on WordPress.org is now called Stop Spammers Classic. Its listing says the project has moved to a successor called Dam Spam and that Classic receives security patches only. Dam Spam itself sits at 2,000 active installs, which is not much of a track record yet.

What it does well is breadth of blocklist checks: it can query Spamhaus, Stop Forum Spam, Project Honeypot and BotScout, plus reCAPTCHA, hCaptcha and 2Captcha. That breadth is also its privacy cost, because enabling those services sends the visitor’s IP address, name and email to third parties.

Price: free, with an optional sponsorship link. Best for: an existing install you do not want to disturb. Skip it if: you are building something new. Pick a tool that is not in maintenance mode.

8. All-In-One Security (AIOS)

Formerly All In One WP Security & Firewall, now AIOS from Team Updraft. 1,000,000+ active installs and 4.7 stars from 1,715 ratings on its WordPress.org listing. Anti-spam is a small part of it: a comment captcha, blocking comment posts that do not originate from your own domain, and auto-blocking IPs with repeated spam comments. The rest is firewall rules, login lockdown, file change detection and database hardening.

Price: the free plugin covers the anti-spam features. Premium on Team Updraft’s pricing page starts at $44.50 for the first year on up to 2 sites and renews at $89.00 a year. That is a genuine 50% first-year discount, so budget for the second year, not the first.

Best for: a site that needs a firewall and treats spam as a bonus. Pair it with a real comment filter. If you got here after an infection rather than a spam wave, start with malware removal plugins instead.

Skip it if: spam is your only problem. This is a lot of plugin to install for a comment captcha.

9. Gravity Forms

Gravity Forms is a form builder, not an anti-spam plugin, and it earns its place here only if forms are your spam problem. It carries a built-in anti-spam honeypot per form, plus an Akismet integration and captcha support, so the protection travels with every form you build rather than sitting in a separate settings screen.

Price: from the Gravity Forms pricing page, Basic is $59/yr for 1 site, Pro $159/yr for 3 sites, Elite $259/yr for unlimited sites. No separate renewal price is published, so confirm at checkout. There is no free tier.

Best for: sites where the forms are the business. Cleaner submissions are also the boring half of any attempt to increase conversion rate, because you stop measuring bots.

Skip it if: you are buying it for the anti-spam. $59 a year for a honeypot is a bad trade when Turnstile is free.

10. Jetpack

Here is the part the marketing pages leave implicit: Jetpack’s spam filtering is Akismet. Same company, same service, different wrapper. So the only reason to buy Jetpack for spam is if you also want the backups, scanning and CDN in the same bill.

Price: the Jetpack pricing page bundles it. Security includes comment and form spam protection at 10,000 API calls a month for ₹584.95 a month billed yearly for the first year, or ₹7,019.40, then renews at ₹1,171.95 a month, or ₹14,063.40 a year. Complete raises the allowance to 60,000 calls at ₹1,465.95 a month for the first year (₹17,591.40), renewing at ₹2,933.95 a month (₹35,207.40 a year). Like Akismet’s, this page switches currency by location; it quoted INR at the check date.

Best for: sites already committed to Jetpack. If backups are the real reason you are looking, compare it against standalone WordPress backup plugins before the renewal doubles.

Skip it if: you only want spam filtering. Buy Akismet directly and skip the bundle.

What most roundups get wrong

Four things go unsaid in almost every list of anti-spam plugins, and all four cost real money or real trust.

1. The free Akismet key is not free for most sites reading this. Every roundup recommends Akismet as the free option. Akismet’s own documentation says a free key does not cover ads, affiliate links, donations, e-commerce, live chat or promoting a business, and that noncompliance means suspension without notice. That description fits the majority of self-hosted WordPress sites. It is not a technical limit you will hit gradually; it is a licensing term.

2. A free plugin and a free service are different products. CleanTalk’s plugin is GPL and costs nothing. The filtering it performs is a subscription. When the subscription lapses, the plugin stays installed and stops protecting you. Same shape as Jetpack, where the plugin is free and the spam module is not.

3. Two of the names still being recommended are not what they were. WP Cerber was closed on WordPress.org on 22 September 2022 and is still listed as unavailable for download, which means no directory updates and no public review history. It is still sold and updated from the vendor’s own repository, so it is not abandoned — but installing it means opting out of the WordPress.org update channel, and that is a decision, not a detail. Stop Spammers Classic, meanwhile, is in security-patch-only mode.

4. Blocklists are a data transfer. Plugins that query Spamhaus, Stop Forum Spam, Project Honeypot or BotScout send the commenter’s IP address, name and email to those services. Cloud filters send the comment body. That is a processor relationship, and it belongs in your privacy policy whether or not the plugin mentions it. Antispam Bee’s default local-only mode is the outlier here, not the norm.

One more, less about spam than about the neighbors: none of these tools is a substitute for a hardened site. If your login page is the thing under load, you want WordPress security plugins and rate limiting, not a comment filter.

Which one should you actually install?

• Personal blog, no ads, no affiliate links, no shop: Akismet’s free Personal key. You genuinely qualify, so use it.
• Commercial site, no budget: Antispam Bee for comments, Turnstile on the forms. Both free, and both licensed for what you are doing.
• Commercial site with real traffic: CleanTalk at $12 a year. Covers comments, registrations and forms from one settings screen.
• Agency or freelancer with ten-plus sites: CleanTalk’s 10-site license at $69 a year, which is $6.90 per site.
• Already paying for Jetpack: you already have Akismet. Do not buy a second filter.
• Spam is only on your forms: Turnstile, and stop there. Do not install a comment filter for a form problem.

Frequently Asked Questions

Our verdict

Install CleanTalk. Twelve dollars a year covers comments, registrations and forms, it shows visitors nothing, and it does not care whether your site is commercial. If twelve dollars is twelve dollars too many, run Antispam Bee and put Turnstile on your forms. That combination is free, licensed for commercial use, and covers the same ground with one more settings screen to manage.

Use Akismet only if your site is genuinely personal, or if you are willing to pay its commercial rate. And whichever you choose, spend five minutes in Settings > Discussion first. The free checkboxes do more work than any plugin gets credit for.