How do I disable comments in WordPress, or stop comment spam?

Why it matters

Comment spam does more than clutter your moderation queue. Spam links that slip through point from your site to places you'd never recommend. Pending comments pile up in the database. And on a store, fake product reviews can sit next to real ones and make the whole review section look untrustworthy.

The quiet truth is that many sites don't need comments at all. A business site, a portfolio or a store's blog often receives more spam than conversation. Closing comments there isn't giving up; it's removing a door nobody uses.

Where comments do matter, the same invisible checks that stop form spam work here too: bots fill hidden fields, post too quickly, repeat from the same IP and paste links.

A quick way to decide, per surface:

Common mistakes

• Closing comments only for new posts. The Discussion setting doesn't touch old posts, and old posts are where bots aim.
• Hiding the comment form but leaving the endpoint open. Bots don't need your form. They post straight to wp-comments-post.php.
• Treating reviews like comments. Closing everything to stop blog spam can also remove product reviews and star ratings from a store.
• Leaving pingbacks on. They're a steady trickle of spam for almost no benefit.
• Auto-deleting anything suspicious. Hold doubtful comments; don't bin them.

Without a plugin

To close comments everywhere by hand:

1. Settings → Discussion: uncheck "Allow link notifications from other blogs (pingbacks and trackbacks)" and "Allow people to submit comments on new posts".
2. Posts → All Posts: select all, choose Edit in Bulk actions, set Comments to "Do not allow" and Pings to "Do not allow".
3. Optionally, close comments on posts older than a number of days, in Settings → Discussion.

Then reject direct posts to the comment endpoint, for example in a must-use plugin:

<?php
add_filter( 'comments_open', '__return_false', 20 );
add_filter( 'pings_open', '__return_false', 20 );
add_action( 'pre_comment_on_post', function () {
    wp_die( 'Comments are closed.', 403 );
} );

This works, but it closes everything, including product reviews if you run WooCommerce, and it doesn't remove the Comments menu or the REST comment endpoints. If you want comments open but filtered, you're back to adding honeypots and limits by hand, or using a cloud service.

If something goes wrong

• Real comments are not showing up. Look in the quarantine first. If you're in Block mode, switch to Monitor for a few days and check the log.
• Product reviews vanished. You probably closed reviews along with comments. Set Product reviews back to "Protected".
• Spam continues after closing comments. Clear your page cache; cached pages may still show the old form. Bots posting directly are rejected either way.

With Hushfort

Hushfort's Spam Shield treats each surface separately. For post comments and for WooCommerce product reviews you choose:

• Protected: open, with bots filtered out by a honeypot, fill-time check, signed token, link limit and per-IP limits;
• Off: removes the comment form, comment list, REST endpoints and the Comments admin menu, and rejects bots posting directly to wp-comments-post.php;
• Don't touch: Hushfort stays out.

Pingbacks and trackbacks can be switched off in the same screen. Doubtful comments go to quarantine with "Not spam" learning, and a Monitor mode so you can check before it blocks. Nothing is sent to an outside service.