Drowning in Spam Comments? Automate Moderation Properly

To automate WordPress comment moderation properly, you need three layers working together: a hold-first rule for every new commenter, keyword and IP filtering for the obvious junk, and AI moderation for the spam that looks like a real comment. Krom Automation handles all three from a single visual workflow, with AI Content Moderation included free, no paywall and no per-check billing.

Most sites run one layer, maybe two. They block the words they already know, approve returning users automatically, and call it done. That setup catches the simple stuff.

It does nothing for the sophisticated spam that avoids known phrases, uses fresh accounts, and reads like a genuine reply. That content clears keyword filters every time.

This guide covers why keyword rules fail at scale, what AI moderation actually catches that rules miss, how to structure a hold-first workflow that protects legitimate comments from accidental deletion, and what the full setup looks like inside Krom Automation’s free tier.

Browse the full feature list to see every trigger and action available before you build your first workflow.

Why Keyword Filters Fail (And What They Cost You)

WordPress ships with a built-in keyword blocklist under Settings, Discussion. Any comment containing a blocked word goes straight to the moderation queue or trash, depending on your configuration.

It is simple and it is free. It is also the reason spam keeps arriving.

The problem is that keyword rules are static. You add words after you see them.

Spammers change phrases before you do. A blocklist that catches “cheap SEO services” does nothing for “affordable search engine optimisation solutions”, which carries the same intent and passes every filter you wrote last month.

• False negatives: Paraphrased spam clears your blocklist and lands as approved, especially if the account has posted once before.
• False positives: Blocking “casino” trashes legitimate comments from readers discussing game design or travel. Recovering those manually takes real time.
• Maintenance cost: A blocklist that works takes constant updating. Sites that stop updating it within 3 to 6 months end up with a list that matches nothing current.
• No context: Rules see words, not intent. A comment that says “great post, check out my site” from a fresh account looks identical to the same sentence from a regular reader.

Akismet improves on raw keyword matching by using a shared spam database. It is good at what it does.

But Akismet is a binary decision: spam or not spam. It does not give you conditional logic, it does not let you route suspicious comments to a reviewer rather than the trash, and it does not learn anything specific to your audience.

A blocklist that works takes constant updating. Sites that stop maintaining it within six months end up with rules that match nothing current and miss everything new.

Start on Hold, Not on Delete

The most common moderation mistake is auto-deleting comments that match a rule. The logic feels sound: if it looks like spam, remove it.

The problem is that false positives from auto-delete are unrecoverable. A reader who leaves a thoughtful comment and watches it vanish does not come back.

Hold-first is the correct default for any comment from an account that has never been approved before. Holding gives you a queue to review. Deleting gives you nothing to recover from.

The queue costs you 5 to 10 minutes a week on a typical blog. A false deletion costs you a reader permanently.

WordPress has a native setting for this: “Comment author must have a previously approved comment.” Enable it and every first-time commenter lands in the moderation queue regardless of what they wrote. Returning commenters with at least one approved comment skip the queue automatically. That single setting eliminates a large portion of your review burden without any risk of deleting something legitimate.

The gap is what happens in the queue. Native WordPress gives you approve, trash, or spam.

It does not let you run a second check, notify a reviewer, or apply different handling based on what the comment actually contains. That is where workflow automation fills in.

What the Workflow Actually Looks Like

Krom Automation includes two comment triggers in the free version: Comment Submitted and Comment Approved. Both fire at their respective moments and pass the full comment data as merge tags into any action you connect downstream.

A practical three-step workflow for new comments looks like this:

1. Trigger: Comment Submitted, fires the moment a comment is posted, before it appears publicly.
2. Action: AI Content Moderation, sends the comment body to your chosen AI provider and returns a classification. You set the threshold and the categories to check.
3. Conditional branch: if the moderation result flags the comment, route to Update Comment Status (set to spam or hold for review). If it passes, route to a notification or leave the default WordPress handling in place.

The conditions and branching documentation covers how to set up Yes/No paths in detail. The AI Content Moderation action setup, including which providers are supported and how to connect your API key, is covered in the AI actions documentation.

You can extend this workflow with a delay if you want to batch review flagged comments rather than get a notification per comment. The delays and scheduling documentation shows how to hold an action for minutes, hours, or days before it executes.

Holding a suspicious comment costs you nothing. Auto-deleting a legitimate one costs you the reader who wrote it and everyone who would have read their reply.

What AI Moderation Catches That Rules Miss

AI Content Moderation in Krom Automation does not look for specific words. It evaluates meaning, tone, and intent against categories you define. The difference in catch rate is significant for anything that paraphrases around a blocklist.

Specific things AI catches that keyword rules do not:

• Contextual spam: “Love the article, here is something related you might find useful” followed by a commercial link. No blocked words, clearly promotional.
• Translated spam: Comments written in a mix of languages or using unusual character substitutions to avoid exact-match filters.
• Thin engagement bait: Very short compliments with no substance, posted from new accounts at high frequency. Human reviewers spot these quickly. Keyword rules never see them.
• Coordinated low-quality comments: Multiple accounts posting similar but not identical content. AI moderation detects the pattern even when each comment individually looks borderline.

Krom Automation supports OpenAI (GPT-4o Mini and GPT-4o), Google Gemini (2.0 Flash, 2.5 Flash Preview, 2.5 Pro Preview), and Groq (Llama 3.3 70B, Llama 3.1 8B) for AI actions. You connect your own API key. wpRigel does not charge per moderation check and does not mark up token costs.

A typical comment moderation check using GPT-4o Mini costs a fraction of a cent. At 500 comments a month, the AI cost is under $1.

Comparing Your Moderation Options

Approach	What it catches	False positive risk	Recovery from mistakes	Maintenance required
Native WordPress keyword blocklist	Exact and partial phrase matches only	High if blocklist is broad	None if set to auto-delete	Constant, weekly updates to stay current
Akismet	Known spam patterns via shared database	Low for obvious spam, higher for borderline	Spam folder, 15-day retention	Minimal, database updates automatically
Hold-first rule only	Everything from new accounts	None, human reviews each one	Full recovery, nothing is deleted	None, but queue grows with volume
Krom Automation with AI Content Moderation	Keyword spam, contextual spam, intent-based patterns	Lower than rules alone, tunable by threshold	Full recovery when set to hold rather than delete	Near zero, AI handles pattern detection

The Cost of Doing Nothing at Scale

Manual comment moderation on a busy site takes longer than most site owners estimate. At 200 new comments per week, spending 20 seconds per decision adds up to roughly 66 minutes.

At 500 comments per week it exceeds 2.5 hours. Neither figure accounts for the comments that need a second look, or the ones where you need to check the commenter’s history before deciding.

Database bloat is the other cost that rarely gets counted. Unapproved and spam comments sit in the database at full size. A site that has run without automated spam handling for 3 years can accumulate tens of thousands of rows in the comments table.

That affects query performance, backup size, and migration time. Cleaning it up retroactively takes longer than the automated setup would have taken.

500 comments a week at 20 seconds each is 2.5 hours of moderation work. That is a part-time job you are doing manually for no reason.

The less obvious cost is the false negatives that go public. A spam comment that clears your filters and gets auto-approved appears on your site, gets indexed, and may send ranking signals you did not intend. Removing it later requires finding it first, which on high-volume sites means combing through archives.

What Each Setup Costs in Year One

Setup	Plugin cost (year 1)	AI API cost estimate (500 comments/month)	Manual time saved per week
Native WordPress settings only	$0	$0	Minimal, queue still fills
Akismet Personal	$0 (personal blogs) or $10/month commercial	$0	Moderate, obvious spam filtered
Krom Automation free with AI actions	$0	Under $1/month at GPT-4o Mini rates	1 to 2.5 hours depending on volume
Krom Automation Pro (Basic, 1 site)	$119/year	Under $1/month at GPT-4o Mini rates	1 to 2.5 hours plus advanced integrations

Setting the AI Threshold Correctly

AI moderation returns a confidence score, and you control what happens at each threshold. Setting it too aggressive flags legitimate comments from readers who used an unusual phrase.

Setting it too loose defeats the point. The right starting point is to route anything above 0.7 confidence to a hold status, not to trash, and review the held queue weekly for the first month.

After 4 weeks you will have a real sense of your site’s false positive rate. Most sites find it low enough to tighten the threshold further, sending high-confidence flags directly to spam.

A small number of sites, particularly those covering topics adjacent to common spam categories, need a slightly looser threshold to avoid losing real comments. The hold-first approach gives you that calibration window without losing anything permanently.

Krom Automation’s workflow simulator lets you run a test comment through the full workflow without executing any actions. That means you can verify your threshold logic before it goes live. See the workflow simulator documentation for how dry runs work.

Handling Comments Across Multiple Sites

If you manage more than one WordPress install, the multisite angle matters. Native WordPress comment settings are per-site and require manual configuration on each install. A blocklist update you make on site one does not propagate to site two.

Krom Automation workflows are exportable as portable JSON. You build the comment moderation workflow once, export it, and import it to each additional site in under 2 minutes.

The AI configuration travels with the workflow structure; you supply the API key per site. For agencies managing 10 or more client sites, that is the difference between an afternoon of work and a week of it.

If you want to read more about how this fits into a broader agency workflow, the WordPress automation for agencies guide covers multi-site management in detail.

What to Build First (In Order of Impact)

Work through these in order. Step 3 adds value only if step 1 is in place, and setting up AI moderation before you have a hold rule active means flagged comments may still auto-approve through default settings.

1. Enable hold-first in WordPress Discussion settings. Require a previously approved comment before any new commenter bypasses the queue. This one change removes roughly 60 to 80 percent of manual review burden on most sites.
2. Install Krom Automation and configure the Comment Submitted trigger. Connect it to the AI Content Moderation action. Set the result to hold, not trash. Download the free plugin from the WordPress.org plugin directory.
3. Add a conditional branch for high-confidence flags. Route anything above your chosen threshold to Update Comment Status set to spam. Route borderline scores to hold for manual review. Leave passing comments to WordPress default handling.
4. Add an email notification for flagged comments. Use Krom Automation’s Send Email action on the flagged branch. Include the comment content and author as merge tags so the notification contains everything you need to decide without logging in.
5. Enable auto-close on old posts. WordPress Discussion settings let you close comments on posts older than a set number of days. Posts older than 6 months rarely receive legitimate comments and frequently attract spam. Closing them cuts incoming volume without any workflow complexity.

What This Setup Does Not Cover

Honest limitations are worth naming before you build.

• AI moderation requires your own API key. If you do not have an OpenAI, Google Gemini, or Groq account, that is a prerequisite. Setup takes under 5 minutes but it is a step.
• WP-Cron dependency for delayed actions. If your workflow includes a delay, execution depends on WordPress Cron firing. On very low traffic sites, delays may run late unless you configure a real server cron.
• Comment metadata and history are per-site. The “previously approved commenter” rule in WordPress does not transfer across domains. A trusted reader on site one is a new commenter on site two.
• Krom Automation moderation acts on the trigger event, not retroactively. It will not re-process comments that arrived before the workflow was active. Existing spam in your queue needs a bulk action from the WordPress comments screen.

Our Verdict

If your site receives more than 50 comments a month, the manual queue is already costing you more time than the setup takes. Enable hold-first in Discussion settings today, it costs nothing and immediately stops the most obvious spam from auto-publishing. Add Krom Automation with AI Content Moderation for everything that looks like a real comment but is not.

The free tier covers everything described in this article: the Comment Submitted trigger, the AI Content Moderation action, conditional branching, email notifications, and the workflow simulator. You do not need Pro to automate comment moderation properly. Pro becomes worth it when you need scheduled workflows, advanced integrations, or the same setup replicated across many client sites quickly.

If you are still deciding whether automation is worth the investment at all, the automation ROI guide walks through how to calculate the actual return for your specific volume.

Sites that should not spend time on this: very low volume personal blogs receiving fewer than 10 comments a month, where native WordPress settings and a 5-minute weekly review is genuinely sufficient. For everyone else, the manual approach is the more expensive one.

See the full pricing breakdown including what the free tier covers and what each Pro plan adds. The free plugin is a permanent free tier, not a trial, and comment moderation automation is fully included.

Frequently Asked Questions

Is Akismet enough to automate WordPress comment spam filtering?

Akismet handles obvious spam well using its shared database. It does not catch sophisticated spam that paraphrases around known patterns, and it does not support conditional routing, so you cannot hold borderline comments for review rather than auto-trashing them. For most sites, Akismet plus a hold-first rule plus AI moderation gives significantly better coverage than any single layer alone.

Can I auto-approve comments from returning users without approving everyone?

Yes. WordPress Discussion settings include “Comment author must have a previously approved comment.” Enable this and returning commenters with at least one approved comment bypass the queue automatically.

New accounts always go to the queue. This is the single highest-impact native setting for reducing manual review time.

What happens if AI moderation flags a legitimate comment?

If you route flagged comments to hold rather than trash, nothing is lost. The comment sits in your moderation queue and you approve it manually.

This is why the hold-first approach matters: a held comment costs you 30 seconds to approve. A deleted comment costs you the reader who wrote it.

How do I automatically close comments on old WordPress posts?

Go to Settings, Discussion and enable “Automatically close comments on posts older than X days.” Most sites set this between 180 and 365 days. Posts past that threshold stop accepting new comments entirely, which eliminates the long-tail spam that old articles attract without requiring any plugin or workflow.

Can I give a team member access to moderate comments without making them an admin?

WordPress includes an Editor role that can manage comments, including approving, trashing, and marking as spam, without access to plugin settings, user management, or theme controls. Assign Editor to anyone who handles comment moderation and they get exactly the access they need without the risk that comes with admin privileges.