CleanTalk Spam Protection
CAPTCHA-free cloud anti-spam for comments, registrations, WooCommerce and 100+ form plugins, with a firewall for known bots. From $12/year.
Automattic's cloud spam filter for WordPress comments and many form plugins; free keys for personal sites, paid plans for commercial use.
Akismet Anti-spam is the spam filtering service from Automattic, the company behind WordPress.com. The plugin sends each new comment (and, through integrations, form submissions) to Akismet’s cloud, where it is compared against a very large history of spam seen across millions of sites. Likely spam is moved to the spam folder automatically, and the worst cases can be discarded outright, so there is no CAPTCHA or puzzle for visitors to solve.
The plugin itself is free on WordPress.org, but it needs an API key. Personal, non-commercial blogs can use a name-your-price Personal plan (including $0), while business and commercial sites are expected to buy a Pro or Business subscription. Plans are metered by monthly spam checks rather than features, so the filtering is the same on every tier.
Its biggest strength is accuracy on comment spam with almost no setup, backed by a service that has been running since 2005. Because it is built by Automattic and often preinstalled, compatibility with themes and comment features is rarely an issue.
The limitations are clear, though. Akismet’s own documentation says it does not check user registrations, and it does not protect login forms or WooCommerce checkout, so stores fighting fake accounts or card-testing need another tool alongside it. There are no IP, country or word block lists in the plugin, and every check sends submission data to Automattic’s servers, which some EU site owners will want to cover in their privacy policy (an optional notice under comment forms helps here).
Pick Akismet if comment and contact-form spam is your main problem and you are happy with a hosted service. Commercial sites should budget for the Pro plan, and anyone who needs login, registration or checkout protection should pair it with a CAPTCHA or firewall plugin.
Best for: Blogs and content sites whose main problem is comment and contact-form spam, and who are happy to use a hosted filter.
Akismet remains a dependable default for comment spam, and its form-plugin integrations make it useful beyond comments. It is not a complete anti-bot solution, though: registrations, logins and checkout need another layer, and commercial sites have to budget for a paid plan.
What Akismet Anti-spam highlights on its WordPress.org page and its own website, split by version.
18 of 46 features we track in CAPTCHA & Spam, feature score 43/100
Supports Google reCAPTCHA (v2 checkbox, invisible or v3 score-based).
No CAPTCHA providers; Akismet filters in the background instead of challenging visitors.
Supports Cloudflare Turnstile, the privacy-friendly CAPTCHA alternative.
Cloudflare Turnstile is not offered.
Supports hCaptcha challenges.
hCaptcha is not offered.
Own image, math or puzzle CAPTCHA with no third-party service.
No built-in image or math CAPTCHA.
Hidden fields and timing checks that catch bots without a visible challenge.
Adds a hidden honeypot textarea and a JavaScript timestamp field to protected forms.
Submissions checked against a cloud spam database of known spammers.
Every submission is checked against Akismet's global spam database in the cloud.
Blocks bots without asking visitors to solve anything.
Works with no visitor interaction; nothing to solve or tick.
Protects WordPress comments from spam.
Core purpose: filters comments, pingbacks and trackbacks automatically.
Protects the login and lost-password forms.
Akismet checks submitted content, not login or lost-password forms.
Protects the user registration form.
Vendor docs state Akismet does not check WordPress user registrations.
Protects WooCommerce checkout, login and registration forms.
Filters WooCommerce product review spam only; no checkout, login or registration checks.
Works with popular form plugins such as Contact Form 7, WPForms or Gravity Forms.
Integrates with CF7, Gravity Forms, WPForms, Fluent Forms, Formidable, Forminator, Ninja Forms and more.
Protects forms built in Elementor, Divi or similar builders.
Elementor Pro forms have a built-in Akismet option; other builders not documented.
Protects BuddyPress, bbPress, Ultimate Member or similar.
BuddyPress and bbPress include native Akismet checks for activity and forum posts.
Block or allow specific IPs, emails, words or user roles.
No IP, email or word block lists in the plugin (WordPress core's disallowed keys still apply).
Block submissions by country or language.
No country or language filtering.
Log of blocked submissions with counts and reasons.
Comment status history plus a stats dashboard of spam caught over time.
Hide the challenge for logged-in or trusted users.
No challenge to hide; moderators are not flagged, other logged-in users are still checked.
Change challenge text, errors, theme or language.
No visitor-facing challenge or error text to customise.
No tracking cookies, data minimisation or a documented GDPR mode.
Optional privacy notice under comment forms and a GDPR page, but data goes to Automattic.
Core protection runs entirely on your own server.
Requires an API key and Automattic's cloud service for every check.
CAPTCHA scripts are only loaded on pages that have a protected form.
Its small front-end script is enqueued from form output hooks, not on every page.
Works across a WordPress multisite network.
Works on multisite; the Business plan covers unlimited sites for networks.
Protects Contact Form 7 forms.
Contact Form 7 has built-in Akismet support, enabled by adding Akismet options to form fields.
Protects WPForms forms.
WPForms has its own Akismet toggle per form; works with a free Personal Akismet key.
Protects Gravity Forms forms.
Via Gravity Forms' own Akismet Add-On, configured per form.
Protects Elementor Pro form widgets.
Elementor Pro forms include their own Akismet integration (paid Elementor plan).
Protects Ninja Forms forms.
Ninja Forms provides an Akismet Anti-spam action you add to each form.
Protects Formidable Forms forms.
Formidable Forms has a built-in Akismet option, enabled per form.
Protects Fluent Forms forms.
Fluent Forms has a built-in Akismet setting in its global settings.
Protects Forminator forms.
Forminator has a built-in Akismet option, configured per form.
Protects Divi contact form modules.
Divi's contact form spam protection supports only reCAPTCHA and a basic captcha; Akismet's list omits Divi.
Protects EDD checkout, login or registration.
Akismet checks content, not checkout, login or registrations, and lists no EDD integration.
Protects BuddyPress registration and activity.
BuddyPress ships its own Akismet checks for activity updates; registrations are not checked.
Protects bbPress topics and replies.
bbPress has a built-in Akismet extension that checks new topics and replies.
Protects Ultimate Member login and registration.
Akismet does not check user registrations or logins, which is what Ultimate Member forms are.
Protects MemberPress signup and login.
Akismet does not check user registrations or logins, so MemberPress signups are not covered.
Protects MC4WP newsletter sign-up forms.
Protects wpDiscuz comment forms.
wpDiscuz saves normal WordPress comments and documents use alongside Akismet's comment filter.
Protect any custom form via shortcode, function or hooks.
Custom forms can call the Akismet API; vendor points to PHP examples and libraries.
Blocks known spam bots before pages load.
No bot firewall; Akismet only checks submitted content after it is posted.
Rejects throwaway or fake email addresses.
No disposable email blocking; Akismet classifies submitted content instead.
Stops bots testing stolen cards at WooCommerce checkout.
Vendor says WooCommerce order fraud needs a separate anti-fraud solution.
Blocks spam or abuse through the REST API or XML-RPC.
Filters spam pingbacks (sent via XML-RPC); no wider REST API or XML-RPC protection.
Review blocked submissions and approve false positives.
Spam is kept in the Spam folder; marking it Not Spam restores it and trains Akismet.
Test keys, debug logs or a test mode to check setup safely.
Test with the name or email 'akismet-guaranteed-spam' to confirm filtering works.
On WordPress.org
1 site
Name-your-price plan for personal, non-commercial sites and blogs; $0 is allowed.
1 site
$9.95/month billed yearly; 500 spam checks/month and email support. Higher-volume Pro tiers cover up to 4 sites.
Unlimited
$49.95/month billed yearly; 5,000 checks/month, priority support, suits networks and multisite. Enterprise is quote-only.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Active installations reported by WordPress.org.
Sites/users claimed on the vendor's website. source
Our estimate, see method below.
How we estimated this: About 7.5M free installs x 3.5% (the usual share of free sites that also run the paid version when a hosted service whose free tier is generous, lower for very large free bases) gives 260K. The vendor figure (100M+) is more than 8 times the free installs, so it probably counts more than this plugin (other products or platforms) and we leave it out. Likely range: 130K to 520K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
303,616 downloads last week, 408.4M all time
| Version | 5.7.2 |
|---|---|
| Last updated | 18 Aug 2026 (77 days ago) |
| Tested up to | WordPress 7.1.4 |
| Requires | WordPress 5.8+, PHP 7.2+ |
| Support threads (2 months) | 0 of 1 resolved |
| On WordPress.org since | 20 Oct 2005 |
| Founded | 2005 (source, 6 Oct 2026) Vendor states it has been blocking spam since 2005. |
|---|
CAPTCHA-free cloud anti-spam for comments, registrations, WooCommerce and 100+ form plugins, with a firewall for known bots. From $12/year.
Free plugin that adds hCaptcha to WordPress core, WooCommerce and 60+ form, builder and community plugins, with honeypot and IP controls.
WebFactory's free CAPTCHA and login-protection plugin with reCAPTCHA and a built-in math CAPTCHA; WP Captcha PRO adds hCaptcha, Turnstile and a firewall.
Free plugin that adds Cloudflare Turnstile CAPTCHA to WordPress, WooCommerce and 30+ form, membership and community plugins.
Honeypot anti-spam plugin that blocks bots on comments and many form plugins with no CAPTCHA, API key or external calls; Extended adds…
Freemium CAPTCHA plugin: free reCAPTCHA for core WordPress forms; Premium adds hCaptcha, Turnstile, WooCommerce, form plugins and geoblocking.
Yes. Akismet Anti-spam has a free version on WordPress.org. Paid plans start at $119.40/yr.
WordPress.org reports 5M+ active installations of the free version. The vendor claims 100M+ sites in total. We estimate around 260K sites run the paid version.
No: not included. No CAPTCHA providers; Akismet filters in the background instead of challenging visitors.
No: not included. Cloudflare Turnstile is not offered.
Yes: included. Every submission is checked against Akismet's global spam database in the cloud.
Yes: included. Core purpose: filters comments, pingbacks and trackbacks automatically.
No: not included. Akismet checks submitted content, not login or lost-password forms.
Yes: partial. Filters WooCommerce product review spam only; no checkout, login or registration checks.
Yes: included. Integrates with CF7, Gravity Forms, WPForms, Fluent Forms, Formidable, Forminator, Ninja Forms and more.
No: third-party. Contact Form 7 has built-in Akismet support, enabled by adding Akismet options to form fields.
The plugin is free, and personal non-commercial sites can use the name-your-price Personal plan at $0. Business or commercial sites are expected to buy Pro ($119.40/year) or Business ($599.40/year).
No. Akismet's own docs say it does not check WordPress user registrations, so you need a CAPTCHA or another anti-spam tool for sign-up forms.
Jetpack forms work automatically; Contact Form 7, Gravity Forms (via add-on), WPForms, Fluent Forms, Formidable, Forminator, Ninja Forms, WS Form, GiveWP and Elementor Pro forms can be configured to use it.
No. It works invisibly in the background, using its cloud database plus a hidden honeypot field, so visitors never see a challenge.
Automattic publishes a GDPR page and the plugin can show a privacy notice under comment forms, but submissions are sent to Automattic for analysis, so mention it in your privacy policy.
Last updated 6 Oct 2026. Spotted something wrong? Suggest an edit.