How to Ban IP Addresses to Stop WordPress Comment Spam (2026)
Can you ban IP addresses to stop WordPress comment spam? Yes, and when a few IPs keep hammering your comment form, an IP ban stops them before they ever reach your spam folder. In 2008 we used the WP-Ban plugin and our spam comments dropped to almost zero. Spammers now rotate through thousands of IPs, so IP bans work best alongside a good spam filter. Here are the ways to ban an IP in WordPress in 2026, from the built-in settings to your firewall.
Quick answer: To ban an IP address in WordPress, copy the spammer’s IP from Comments, then add it to Settings > Discussion > Disallowed Comment Keys to send their comments straight to trash. To block the IP from your whole site, use a plugin such as WP-Ban or your security plugin, or block it in Cloudflare or .htaccess. Keep Akismet or another spam filter running, because most spam comes from changing IPs.
Table of Contents
How to find a spammer’s IP address
In Comments, each comment shows the author’s IP address under their email. Click the IP to see all comments from that address. If dozens of spam comments share one IP or a narrow range, it’s worth banning.
Method 1: Disallowed Comment Keys (built into WordPress)
Go to Settings > Discussion and paste IPs, one per line, into Disallowed Comment Keys (called Comment Blacklist before WordPress 5.5). Any comment from those IPs goes straight to the trash. On the same screen:
- Set Comment Moderation to hold comments with 1 or more links. Most spam includes links.
- Turn on Comment author must have a previously approved comment.
- Close comments on older posts automatically after 30 to 90 days if old posts attract most spam.
This blocks comments but not visits, which is usually what you want.
Method 2: Ban IPs with a plugin
WP-Ban, the plugin we used in 2008, is still maintained. It bans users by IP, IP range, host name, user agent or referrer, shows them a custom message, and keeps stats on blocked attempts. Security plugins such as Wordfence also let you block IPs, IP ranges and whole countries from their firewall settings.
Method 3: Block IPs in Cloudflare
If your site uses Cloudflare, go to Security > WAF > Tools (IP Access Rules) and block the IP or range. Blocked visitors never reach your server, which also saves resources.
Method 4: Block IPs in .htaccess
On Apache or LiteSpeed servers, you can add rules to the .htaccess file in your site root:
<RequireAll>
Require all granted
Require not ip 203.0.113.45
Require not ip 198.51.100.0/24
</RequireAll>Back up .htaccess first, because a typo can take your site offline. Nginx servers use deny rules in the server config instead.
Be careful when you ban IPs
- Never block your own IP or your office’s network.
- Avoid huge ranges: many readers share IPs through mobile networks, so wide bans can block real visitors and even search engine bots.
- Review bans regularly: spammers move on, and old banned IPs may be reassigned to real users.
Better long-term protection against comment spam
IP bans are a quick fix. For lasting protection, combine them with a spam filter. Akismet has blocked millions of spam comments on our site over the years. See our list of the best WordPress plugins to stop comment spam, and how to stop Akismet auto-deleting comments so you can rescue real ones.
Frequently asked questions
Does banning IPs stop all comment spam?
No. Most spam bots use many IPs. Bans stop repeat offenders; filters like Akismet catch the rest.
What replaced the WordPress Comment Blacklist?
Since WordPress 5.5 it’s called Disallowed Comment Keys, under Settings > Discussion.
Can a banned person still read my blog?
With Disallowed Comment Keys, yes; only their comments are blocked. With WP-Ban, Cloudflare or .htaccess, they can’t load the site.
How do I unban an IP?
Remove it from the list where you added it and save the settings.
Stuck on a gift? Try our free Gift Idea GeneratorIdeas for anyone by age, job, interests and budget, with Amazon.com and Amazon.in linksFind gifts →Get our free weekly email: new tech guides and tools, no spam.
New and updated tech guides, a free tool worth bookmarking and one useful pick, once a week. No spam, unsubscribe anytime.
One email a week. Unsubscribe anytime. See our privacy policy.
Spot on with this write-up, I seriously feel this web site needs far more attention. I’ll probably be returning to read more, thanks for the info!
Comfortably, the article is in reality the greatest on this noteworthy topic. I concur with your conclusions and will thirstily look forward to your upcoming updates
the question is: How do you determine the IP of the spammer? Is there any way so you can know at any time the IP? Is there a WP plugin or something?
IP is listed beside every wordpress comments in the wordpress comment moderation screen.
That’s not the real IP, that’s the IP of the server. To prove it, every comment I receive has the same IP.
When we find 100 spam comments with the same IP, we block it. Spam stops.
How can we stop them for sending data, although they won’t get through with their messages?
If you don’t block spammers through htaccess but through filters, they will STILL come and visit your website and eat bandwith by autofilling forms and autopress buttons.
Well it’s good as long as the spammer is using the same ip address!
Nothing can stop 213.5.71.12 from spamming. I’ve tried everything. He’s the devil. IP Ban doesn’t work. Neither does .htaccess restriction.
Can U help me to BAN this Spammers IP (213.5.71.12) with Wp-Ban..??
thnks.
Juts add it to the banned ip list in WP-ban settings.
Putting results to work in therapy. ,
I read all comments and I think this is a great tool anyway. I understand that by blocking IP you may block other innocent users as well, mainly when sharing IP address, but when I started my blog I had a few spams a week and it was easy to manage through Akismet, now I have two blogs and the first is receiving circa 20 spams a day and the second one about 5 – 10 spams a day. About 60% are from the same IP address and I really got tired manually reviewing Akismet list and deleting all the scrap in there, so I wanted something, which would block these addresses at all without me bothering myself by manual deletion of it.
I am also going to create an e-mail form and allow blocked user to send me a message that I am blocking him/her. If I will see in the stats that some blocked IP address has only one or two attempts in a month or so I will release it back, while heavy spammers remain on the black list.
I was really tired of spending my time browsing and deleting all the crap manually. Thanks for this plugin.
Thanks, you know a place where i can get a huge list of IP’s? im setting up a code where you need a php include and all the IP’s are banned :D
Super post though!
I am using IP banning from my .htacceess file. I feel that this is the best option I have. It is the safer.
Jacob Share hit the nail on the head. That’s exactly what I was thinking.
The blog owner said that adding the IP address to the .htaccess file takes a long time, but you still have to do something similar with WP-Ban. So, I’d rather just mark comments as spam or delete them once I actually *see* the comment than just block certain IP addresses from posting to my site, when the abuser may be using a shared IP address from their ISP (or happen to be using the same proxy for whatever reason).
You know folks, you can’t please everyone.. that sounds like the liberal way of doing things.. you get no results without positive action.. spammers use ip’s that are accessable to them.. if these ip’s get blocked by the server (httpd.conf or .htaccess) it just shortens the list of bad servers that are spamming and helps your server to work less. Why even accept an incoming BOT, email or comment when your server can stop them in their tracks. Sure, you may lose a few visitors, but you get to sleep at night not waking up to WordPress emails that have 50 website addresses in them..
Cheers,
Bob
I’ll have to try this out. It should make things a lot easier. I hate it when legitimate commenters get blocked. It’s bad for business!
In the first 30 minutes after installing wp-ban it has already stopped the spambot 6 times. SWEET!!!
This is the plugin that I have been looking for. My WP site has been getting bombarded by comment spam from a know spambot with clearly identified IP’s.
This isn’t a cure all for spam and should be used only in extreme cases. From 6 IP addresses I received 600 spam comments in the last week. This is the type of situation wp-ban should be used for.
It is a tool to use in addition to other spam measures.
glad I can block ips now these spammers won’t stop
The best plugin i ever installed!!!!
BRAVO for the author!!!!
My spam is OVER now!!!
I’m afraid most of these folks are right, and not right. Bad Behavior was a master at cleaning up comment spammers before they got to your blog, but that soon had many problems and couldn’t keep up with all the tricks comment spammers do.
The best usage for the WordPress blacklist and Plugins like this is to specific deflect a troll or some individual you are having a problem with. Not for comment spam. Unfortunately, the web has some trolls so this is more common than you might realize.
But for comment spammers slamming your site, this isn’t a good idea. It’s a giant time waster as they switch IPs and play a lot of games automatically where you have to do it manually. It’s a lot of work to maintain.
There are some changes coming this year, there has to be, to make this flood of nasty on our blogs easier to handle, and seriously penalize the abusers. I’m so proud you are not using CAPTCHAs which absolutely do not work, but this technique has been tried repeatedly and found to be only temporary if anything.
The warning, however, not to block your own IP or use a wild card in the WordPress blacklist and moderation list is very serious. I’ve seen people make a sweeping decision to block all XXX IP addresses or any URL ending in .RU and causing themselves a lot of headaches from users. That’s a good tip.
I find it very ironic that immediately after scanning the headline of this post I clicked on the newest article and received an abrupt You Are Banned message for no apparent reason.
Do you think that alienating a reader now and then is an acceptable downside to these spam protection measures?
Thats strange. Since you accessed the first page from a particular IP, then accessed the new page from the same IP, why should it ban you. As far as I can tell, I have not banned your IP on our site. I need to investigate further.
This appears to be quite a handy plugin that many webmasters/blog owners should implement.
Hi,
Sorry, but this is a truly terrible course of action to recommend. Spammers just don’t use IP’s that belong to them, so all you will block, at best, is compromised machines. Which means, if we are talking about Windows machines, an enormous number of them.
The only thing that I can think of that is a worse idea than IP banning is banning entire countries based on IP ranges.
Use Askimet, or Defensio, and if you are not happy with those, add recaptcha or similar.
They’ll do the trick.
Regular readers and commentators hate captchas. We then tried a maths plugin, which would just not accept the right total. When you get thousands of spam comments, you need a more aggressive tool.
Here’s an example to illustrate why this is a bad idea.
A spammer has tried to post the exact same comment on my site over 20 times in the past 2 weeks. Different articles most of the time, and SpamKarma2 says that *the captcha was filled in”. Best part? Each comment was from a different IP address.
Many spammers use trojans to spread their garbage. By blocking those IPs, you’re blocking potential visitors as well.
The best solution is to use plugins like Akismet, SK2, Wp-Spamfree, etc. that analyze incoming information based on many criteria and automatically decide how to treat it. Then tweak as you go.
I only block IP addresses from which at least 10 definite spam comments come. That way I am sure I am not blocking my readers, and only a few most troublesome IPs are blocked. I let Akismet handle the rest.