[Guide] Block WordPress Spam Comments Using Cloudflare

Hey everyone,

If you're tired of spam comments on your WordPress site, here's a quick method to block most of them using Cloudflare, without installing any extra plugins.

What This Does:
This method stops spam bots that directly target:

• comments-post.php
• /?replytocom URLs (used in threaded comments)

Steps to Set It Up:

1. Log into Cloudflare (or create a free account at cloudflare.com)
2. Add your website to Cloudflare (skip if already added)
3. Go to: Security → WAF → Custom Rules
4. Click on + Create Rule
5. Fill out the rule as follows:
   
   Rule Name: Block WordPress Spam Comments
   
   Conditions:
   
   • URI Path → contains → comments-post.php
   • Click Or, then add:
   • URI Path → contains → /?replytocom
6. Choose Action: JS Challenge
   (This challenges bots with JavaScript — most spam bots fail this.)
7. Save the rule and set its order to First

Here’s a screenshot of what it should look like:


That’s it! Most bot-generated comment spam should stop hitting your site. I am personally using it on many WordPress websites I own.

Let me know if you try it out or have questions!

pankajjangir said:

Hey everyone,

If you're tired of spam comments on your WordPress site, here's a quick method to block most of them using Cloudflare, without installing any extra plugins.

What This Does:
This method stops spam bots that directly target:

• comments-post.php
• /?replytocom URLs (used in threaded comments)

Steps to Set It Up:

1. Log into Cloudflare (or create a free account at cloudflare.com)
2. Add your website to Cloudflare (skip if already added)
3. Go to: Security → WAF → Custom Rules
4. Click on + Create Rule
5. Fill out the rule as follows:
   
   Rule Name: Block WordPress Spam Comments
   
   Conditions:
   • URI Path → contains → comments-post.php
   • Click Or, then add:
   • URI Path → contains → /?replytocom
6. Choose Action: JS Challenge
   (This challenges bots with JavaScript — most spam bots fail this.)
7. Save the rule and set its order to First

Here’s a screenshot of what it should look like:
View attachment 450069

That’s it! Most bot-generated comment spam should stop hitting your site. I am personally using it on many WordPress websites I own.

Let me know if you try it out or have questions!

Click to expand...

Great suggestion; we are using CleanTalk API as well for such spam comments.
This CF rule also triggers JS challenge for valid traffic.