This guide details the essential steps to protect your WordPress site against spam and automated malicious content.

Introduction

• An unprotected website is an easy target for spambots that use comments to spread fraudulent links.
• Without protection, every form (contact, booking, poll) can be exploited to send mass emails from your server.
• Spam degrades your user experience, harms the reputation of your domain (email blacklisting), and can saturate your hosting resources.

1. Master the comment system

By default, WordPress is configured to allow comments. To limit abuse, please refer to the WordPress codex.

If you want to keep the interactions private, you can restrict comments to only logged-in users via the discussion settings page.

2. Use automatic protection tools

To block robots without affecting the user experience of your visitors, two main technologies exist: captcha (visual test) and honeypot (an invisible trap for humans but detectable by robots).

Solution included with Infomaniak

If you installed WordPress using Infomaniak's automatic installation tool, the WP Armour – Honeypot Anti Spam plugin is already activated. It natively protects the most common forms:

• WP Comments & WP Registration
• Contact Form 7, Elementor Forms, Divi Contact Form
• WooCommerce Reviews, BBPress, Gravity Forms

Recommended alternatives

• Akismet Anti-Spam: developed by Automattic, it is a very effective solution, although it is a paid service for commercial websites.
• The anti-spam Sentinel: a comprehensive extension that has received excellent reviews from the French-speaking community.
• Contact Form 7 Honeypot: a specific module if you only use the Contact Form 7 extension.

The role of the hosting provider

Beyond the security of your website, Infomaniak implements protections at the server level. To learn more, please refer to the article on combating malicious emails as well as the FAQ on the security tools available.