WordPress comment moderation is a black box until you dig into the settings. A first-time visitor leaves a thoughtful reply and it vanishes into the moderation queue. A known commenter posts a link and gets flagged as spam. The system uses a set of filtering rules—some visible, some buried—that decide whether a comment goes live, waits for approval, or gets junked.
Understanding how these filters work lets you tune moderation to match your traffic pattern. If you run a low-volume blog, you can loosen the gate. If you attract drive-by spam, you tighten it. The defaults are conservative, built for a web that doesn’t exist anymore.
The approval workflow: three possible destinations
Every comment WordPress receives lands in one of three places: approved and published immediately, held in the moderation queue, or sent to spam (or trash, if you use an external filter like Akismet). The path depends on a chain of checks that run in sequence.
First, WordPress checks whether the commenter has a previously approved comment using the same email address. If yes, and if the “Comment author must have a previously approved comment” box is checked under Settings → Discussion, the new comment publishes immediately. This is the fast lane for repeat commenters. If the box is unchecked, every comment waits for manual approval regardless of history.
Next, WordPress scans the comment body, author name, email, URL, and IP address against two lists: the moderation keyword list and the disallowed keyword list. The moderation list (labelled “Comment Moderation” in the dashboard) holds comments for review. The disallowed list (formerly called the blacklist, relabelled in WordPress 5.5) sends comments straight to spam. Both lists live under Settings → Discussion and accept one keyword or phrase per line.
Finally, WordPress counts links. By default, if a comment contains two or more links, it goes to moderation. You can change that threshold in the “Hold a comment in the queue if it contains [X] or more links” field. Set it to zero and every comment with any link gets held. Set it to ten and you let through link-heavy replies that are probably spam.
Keyword matching: case-insensitive and substring-aware
The keyword filters are simple but powerful. WordPress treats every entry as case-insensitive and matches substrings. If you add “casino” to the disallowed list, it will catch “casino,” “Casino,” and “online-casino-bonuses.” It will also catch “occasion” and “Casiano”—any string containing those letters in sequence.
This substring behaviour causes false positives. A moderation list that includes “free” will flag “freedom,” “freelance,” and “gluten-free.” You can work around this by adding spaces before and after the keyword (” free “), which narrows the match to whole words surrounded by whitespace. It’s not perfect—it won’t catch “free!” or “free.”—but it reduces collateral damage.
The moderation and disallowed lists work independently. A comment caught by the disallowed list never reaches the moderation queue; it skips straight to spam. A comment caught by the moderation list waits for manual review, even if the author has prior approved comments.
IP and email history: where external plugins step in
WordPress core doesn’t maintain a reputation database for IP addresses or email domains beyond the simple “previously approved” check. It doesn’t track how many times an IP has been flagged, or whether an email domain is a known spam source. For that, you need a plugin.
Akismet, bundled with most WordPress installs, sends every comment to its cloud service for scoring. It checks the comment content, author metadata, and submission context against a global spam database and returns a spam/not-spam verdict. Akismet’s accuracy is high, but it’s a third-party dependency with a commercial pricing tier (checked October 2026) for business sites. Free usage is limited to personal blogs.
Antispam Bee, a privacy-focused alternative, runs locally and uses pattern matching, honeypot fields, and country-based IP filtering. It doesn’t phone home, but it also doesn’t benefit from network-effect spam detection. Which tool fits depends on your privacy stance and comment volume.
When to adjust the defaults
If you’re launching a new site with zero comment history, uncheck “Comment author must have a previously approved comment.” Otherwise, every first-time commenter—including engaged readers—waits in the queue, and you create friction where you want conversation.
If your niche attracts keyword-heavy spam (crypto, pharma, affiliate), populate the disallowed list early. Start with obvious terms and expand as patterns emerge. But review the spam folder weekly; automated filters drift and catch legitimate comments over time.
If you cross-post to social media and drive external traffic, raise the link threshold to three or four. Readers who quote sources or share related articles shouldn’t wait for approval. If spam is minimal, you can disable link-count moderation entirely by leaving the field blank or setting it to a high number.
The comment system in WordPress hasn’t changed much in a decade, but the web around it has. Spam is more sophisticated, and legitimate commenters expect instant feedback. Tuning the moderation filters to match your traffic pattern is a small lever that improves the reader experience without adding workload.
Want more infrastructure walkthroughs like this? Subscribe to One Two Three Send—we break down the mechanics of online-business tools every week, no fluff.