Is Turnstile really free?

Yes. Turnstile is available for free with no quota limit, and it works on any site, including sites that do not use Cloudflare as a proxy. Real visitors usually see no puzzle at all, sometimes just a single checkbox.

Should I drop my spam-filter plugin?

Not necessarily. A filter like Akismet judges comments after they arrive at your server, and it is good at that job. The edge layers in this guide reduce how much spam arrives in the first place, so the filter has far less to do. The two work well together.

Will real commenters be blocked?

A challenge is not a block. Real browsers pass a Managed Challenge in about a second, usually without any interaction, while most spam scripts fail it. If you ever see a real visitor complain, switch the rule from Block to Managed Challenge or loosen the expression.

Why do bots hit wp-comments-post.php directly?

Because that file is the endpoint that actually saves a comment. Spam scripts skip your page entirely and send their payload straight to it, which is why a rule on that exact path catches traffic a form-level defense never sees.

Block WordPress Comment Spam Before It Reaches Your Site

If your moderation queue fills up with "Nice post!" links every night, the spam is reaching your server before anything filters it. The steps below move that fight to the edge, so most of it never arrives at all. Everything here works on Cloudflare's free plan.

Where does all this comment spam come from?

From scripts that post comments without ever opening your page. WordPress saves comments through a single endpoint, wp-comments-post.php. Spam bots know this, so they skip your article, skip the comment form, and send their payload straight to that file, thousands of sites at a time. In 2025 roughly 1 in 2 requests to web pages came from bots, and comment endpoints are among their favorite targets because every successful post plants a link.

Why does the spam folder keep filling up even with a filter?

A spam filter such as Akismet judges each comment after it reaches your server. It catches most junk, and your server still runs PHP and touches the database for every single attempt, real or fake. The cleanup also stays in your queue. The layers below work one step earlier: they turn the bot away at the edge, so the comment never arrives, never costs server resources, and never needs moderating.

Step 1: Put Turnstile on your comment form

Turnstile is Cloudflare's free CAPTCHA alternative. Instead of making people solve puzzles, it quietly checks browser signals, so real visitors usually pass with no interaction at all while scripts fail. It is free with no quota limit, and it works on any site, even one that does not use Cloudflare as a proxy.

In the Cloudflare dashboard: Turnstile → Add site, then add the widget to your comment form. On WordPress the easiest route is a small plugin ("Simple Cloudflare Turnstile" is a popular one) that attaches Turnstile to the comment, login, and registration forms with a few clicks: paste in the Site Key and Secret Key from the dashboard and tick the forms you want covered.

Step 2: Challenge direct hits on wp-comments-post.php

Turnstile guards the form. This rule guards the endpoint behind the form, which is where the smarter scripts aim. A Managed Challenge here lets real browsers through and stops most automation cold.

In the dashboard: Security → WAF → Custom rules. Create a rule where the URI path equals /wp-comments-post.php and set the action to Managed Challenge. Custom rules are included on the free plan.

Step 3: Turn on Bot Fight Mode

In the dashboard: Security → Bots, switch on Bot Fight Mode. It challenges traffic that identifies itself as automated, across the whole site rather than just the comment path.

Step 4: Tidy up on the WordPress side

Under Settings → Discussion, close comments on posts older than a set number of days. Old posts attract the most spam and the fewest real comments.
Keep your existing spam filter running. With the edge layers in place it has far less to do, and it remains a good last line for whatever slips through.

How do I know it is working?

Two places tell the story. In Cloudflare, open Security → Events and filter for /wp-comments-post.php: challenged and blocked requests there are spam attempts that no longer reached WordPress. In WordPress, watch your moderation and spam queues over the next few days. Owners who set this up typically see the morning cleanup shrink to nothing, because the noise is turned away before it ever becomes a comment.

Comment spam is one door. The book covers all of them.

The ebook Cloudflare for Website Owners applies this same edge-first approach across 22 chapters: login protection, WAF rules, rate limiting, DDoS, caching, and a dedicated case-study chapter securing WordPress end to end, with real dashboard screenshots at every step. See the WordPress edition of the pitch or the full overview.

Sources: Cloudflare Radar 2025 Year in Review (roughly 1 in 2 web requests from bots). Figures rounded. Cloudflare is a trademark of Cloudflare, Inc.; this guide is by 8grams and is not affiliated with Cloudflare, Inc.

How to Block WordPress Comment Spam Before It Reaches Your Site