The problem with
Akismet is it only filters comments that have been sent already, which is good, but still the comments are sent so still you get server overload.
Here is a trick to prevent spam comments, not using Akismet, and it wont overload your server, on the contrary:
1. Htaccess referrer validation
use this code to block no-referrer requests:
Code:
RewriteEngine On
# block comment spam by denying access to no-referrer requests
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-comments-post\.php*
RewriteCond %{HTTP_REFERER} !.*YOUR-WEBSITE.COM.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule ^(.*)$ [URL]http://www.mattcutts.com/blog/[/URL] [R=301,L]
this will direct all no-referrer requests made to 'wp-comments-post.php' to
Matt Cutts blog
2. Wp-comments-post.php edit
the above method is not enough, cuz the requests are still made. Now, all spam comments' bots abuse this file for sending tons of spam:
'wp-comments-post.php', replacing this file, will cause:
1. they wont be able to send POST requests to send the spam comments cuz the file wont be found
2. they wont be able to find your site in serps cuz you lack the famous foot-print.
Now, if they do send POST requests to 'wp-comments-post.php', they will get a 404 page. Sending thousands of requests to a non existent page, will still cause server overload, cuz the 404 page will load thousands of times, so, best practice is to leave 'wp-comments-post.php' in the server, but it should be empty, and the the original functionality of 'wp-comments-post.php' should be replaced by other file.
i.e., copy the contents of 'wp-comments-post.php' to a different file (and rename it), and leave 'wp-comments-post.php' empty on the server. When the bots will try to send POST requests to it, it will be empty so nothing will happen. it's preferable than loading a 404 page for each request.
You need to find the files that call 'wp-comments-post.php' in the wordpress file system, and replace the call to the new file you created. These are the files that usually call 'wp-comments-post.php'
a. 'comment.php'
b. 'comment-template.php'
3. Cookies
next defense is using cookies to tag real humans. Since all spam comments' bots cannot accept cookies, we can filter them easily by assigning a unique cookie to each real user visiting our blog and testing the cookie existence against that user.
So, go to your theme files, and locate: 'header.php' file. open it, and at the very beginning of the file (between the <?php code blocks of course), paste the following code:
Code:
if(!isset($_COOKIE['user'])){
setcookie("user", $_SERVER["REMOTE_ADDR"].$_SERVER["HTTP_USER_AGENT"], 0 ,'/');
}
this code sets a unique cookie named 'user' to each real user.
second part is validation of cookie existence.
now, open the file you had created at stage 2 (the one that should replace 'wp-comments-post.php' functionality), and paste, at the very beginning of file (between the <?php code blocks of course), the following code:
Code:
if(!isset($_COOKIE['User']) || $_COOKIE['user'] != "".$_SERVER["REMOTE_ADDR"].$_SERVER["HTTP_USER_AGENT"].""){
die();
}
this code snippet tests cookie existence against the real user to whom it was set. Since spam comments' bots cannot accept cookies, script will die.
That's it.
Apply the 3 stages I mentioned above, and you'll never have spam comments.
good luck