You open your comments screen and there are hundreds of messages about casino sites, cheap watches and links you never approved. Or you open your user list and see profiles nobody on your team created. If you need to stop spam comments on your website, the fear arrives before the plan does: will Google punish the whole site, and is this a hack?
Work in this order. Close the door so nothing new gets published, remove what is already there, then check Search Console. A single spam comment does not penalize a site on its own, and a modest problem can often be handled from your own dashboard.
Start with a short check of how big the problem is. The size of it decides how much of the rest you need.
Key Takeaways
Close or moderate every place visitors can write, then delete what is already published, then check Search Console.
Google issues a manual action after a human reviewer finds pages that break its spam policies, and the report shows up in Search Console.
Unknown accounts, redirects or code on your site point to a security problem, which is a different job from comment cleanup.
What should I do first when spam fills my comments or user pages?
Make a list of every place a visitor can put words or a profile on your site. That means blog comments, forums, product reviews, user registration, profile pages and any form that publishes a public page. Each one is a door. Deleting spam from one door while another stays open is how the same mess comes back a week later.
Then run a quick check. WordPress describes the Comments screen as the place to review whether entries are published, pending or marked spam, and the same idea applies to any user-content dashboard.
Ten-minute check
Open your comments or user list and look at the most recent entries first.
Identical text, commercial usernames, unrelated links, gibberish and many entries from one source.
Note whether the spam is published, pending or already marked as spam.
Use `site:yourdomain.com` plus a distinctive spam phrase, in a private browser window.
Do not click anything inside the spam itself.
If the search turns up spam pages in Google, you are past a simple comment cleanup and into indexed user-generated spam, and the removal and Search Console steps in this post apply to you.
Will Google penalize my whole site for spam comments?
No, not automatically. Google's spam policies define user-generated spam as "spammy content added to a site by users through a channel intended for user content." The examples include spammy accounts, forum posts, blog comments and uploaded files. Google also notes that site owners are often unaware of it.
A manual action is a separate event. Google's manual actions documentation says it happens when a human reviewer decides pages do not follow the spam policies. The action can lower rankings or remove some or all affected pages from Search, and the documentation names spam in forums, blog comments and user profiles as user-generated spam.
Size and type of spam matter. Large volumes, indexed spam pages, commercial usernames, advertisements, gibberish and manipulative links are the more serious case. Spam may also be ignored or handled by Google's systems without any manual action. So, the worry about comment spam and SEO is worth acting on, but it is a reason to clean up and check Search Console, not a reason to assume the damage is done.
How do I stop new spam from being published?
Stopping new spam comes before deleting old spam, because cleanup done with the door open never ends. The controls differ by platform, and the menu names used are WordPress's, as WordPress.org documents them. Settings can differ by version, theme, membership system or plugin, so check the labels on your own screen.
Think of the work in layers. Comments need moderation rules. Spam user profiles and registration pages need access limits. Links inside anything a visitor writes need a label that tells Google they are not your endorsement.
Comments: Settings > Discussion
Under Settings > Discussion, WordPress lets you require manual approval for every comment, or require that a commenter already has an approved comment. You can hold any comment containing a set number of links, and add words, names, URLs, email addresses, IP addresses or user-agent strings to the moderation list.
The same screen lets you close comments on posts older than a set number of days and disable pingbacks and trackbacks if you do not use them. You can also turn comments off on individual posts.
Old posts and the Comment Blocklist
Global discussion settings generally apply to future content, so older posts that already accept comments may need individual changes. Open those posts and switch comments off one by one, or use bulk edit in the posts list where your version offers it.
The Comment Blocklist can mark matching comments as spam. WordPress warns that genuine comments may be deleted without notice, so use comment moderation for borderline words and keep the blocklist for terms you never want to see.
User profiles, registration and public pages
If registration creates a public profile or page, the fix is to require approval before the profile goes live, make profiles private, or switch registration off. Ask whether the profile pages need to exist at all. If a page is not meant to appear in search, mark it noindex.
| Where spam gets in | What closes it | Job size |
|---|---|---|
| Open comments on old posts | Close comments after a set number of days, or switch them off per post | Small settings change; older posts may need individual updates |
| Comments that publish instantly | Require approval, hold link-heavy comments, add moderation terms | Small configuration, then ongoing review |
| Registration that creates public profiles | Require approval, make profiles private or restrict registration | Medium, if templates and permissions are involved |
| Untrusted links in user content | Add rel="ugc" or nofollow, and noindex where pages should not rank | Small to medium, depending on the CMS and URL structure |
| Hundreds or thousands of existing entries | Filter, review and bulk delete | Medium when records can be filtered; large when thousands need review |
How do I remove the spam that is already there?
Delete the spam from every area, not only the examples you noticed. Google's guidance on preventing abuse points to the same pattern: remove spam comments, posts, profiles and pages, and stop new submissions. Removing a sample while leaving the submission channel open is the common way for the problem to return.
Filter the list by status, sender or shared text, then use bulk actions where your platform has them. Include accounts, forum posts and generated pages, not just comments. Anything that is still indexed should go out of the live site before you ask Google to look again.
Then label the links that remain. Google recommends `rel="ugc"` for links in user-generated content such as comments and forum posts, and describes it as the preferred marker for links contributed by users. Use `rel="nofollow"` when you do not want Google to associate your site with, or crawl, the linked page. The two can be combined as `rel="ugc nofollow"`. Google's guide to qualifying outbound links explains both.
These attributes reduce association and crawling signals. They do not remove the content or stop it from being published, so they sit on top of moderation rather than replacing it.
How do I check Search Console for a manual action?
Open the verified property in Google Search Console and go to Security & Manual Actions, then Manual actions. If Google has issued one, the report identifies the issue, the scope and sometimes example URLs. Google also sends a message to the Search Console message center. Google's manual action help page walks through the process.
While you are there, look at three more reports. Security issues shows whether Google has flagged the site as compromised. Page indexing shows whether spam URLs are in the index, and whether that count is shrinking after cleanup. Performance shows the queries and pages bringing visitors, so unfamiliar or off-topic queries stand out.
If there is a manual action, clean every affected area, make sure Google can reach the corrected pages, and only then select Request Review. The request should say exactly what the problem was, what you changed and the result. Requesting a review before the whole site is fixed wastes a round.
If there is no manual action, you still have a cleanup to finish, and you can watch the indexed spam count fall.
Is it comment spam, or is my website hacked?
Spam that arrives through an open channel is a policy and cleanup problem. A hack is a security problem. The two get mixed up because unwanted pages look alarming either way, and "hacked" gets used for any content nobody on your team wrote.
Treat it as a security investigation if the spam returns after you tightened the settings, or if the site shows code, accounts, redirects or access nobody approved. That investigation covers accounts, plugins, themes and server logs, and it can call for a full backup, an access review, a malware scan and restoration.
Our posts on spam pages and links injected into your website and on contact form spam cover the nearby cases. This post is about content submitted through public or semi-public channels, not injected code.
When does it make sense to pay someone to help?
You can confirm the problem and apply the basic settings without hiring anyone. A modest comment problem may be handled with Discussion settings, bulk moderation and a short indexing check. You do not need a plugin purchase to do that, and no tool is required in every case.
Help earns its cost in particular situations: many user-generated URLs, indexed spam at scale, a manual action, spam that returns after containment, or an unclear access history. In those cases the useful work is a documented cleanup, containing the submission channel, correct link attributes and indexing rules, and a check that separates user spam from a compromise.
Ask any provider to show what they found, what they changed and what remains uncertain. Cleanup removes the spam and closes the door; it does not come with an instant ranking recovery, so expect a plan and a record of the changes instead.
Can you stop the spam and protect your rankings?
Pick an answer to begin.
1. You find one spam comment on a post. What does Google's guidance say about a penalty?
2. You switched on global comment moderation in WordPress. Why might older posts still collect comments?
3. When should you select Request Review in Search Console?
Frequently Asked Questions About Stopping Spam Comments on Your Website
Can spam comments hurt SEO?
They can create a search-policy problem when spammy user content is published at scale, especially when it is indexed or carries manipulative links. A single comment does not trigger a whole-site penalty.
How do I stop spam user profiles from being created?
Require approval before a profile goes live, restrict or switch off registration, make profiles private, and mark profile pages noindex when they are not meant to appear in search. Then delete the profiles already created.
What does rel="ugc" do?
It tells Google that a link sits inside user-generated content, such as a comment or forum post. Google describes it as the preferred marker for links contributed by users.
What does nofollow do?
It tells Google not to associate your site with, or crawl, the linked page through that link. It does not remove the content or stop it from being published.
Is spam proof that my website was hacked?
No. Repeated spam can come from forms or comments that are still open. Unknown code, accounts or redirects point to a security investigation.
How do I check for a user-generated spam manual action?
Open Google Search Console, go to Security & Manual Actions, then Manual actions. Check Security issues, Page indexing and Performance in the same visit.
The Bottom Line
Close every place a visitor can write, remove the spam from all of them, mark untrusted links with ugc or nofollow, keep user pages you do not want ranked out of the index, and check Search Console for a manual action. Request Review only once the whole site is clean. If anything in the spam looks like code, accounts or redirects you did not approve, treat it as security work.
Done in that order, the problem stops growing and you can see it shrinking: fewer indexed spam URLs, an empty moderation queue and a Search Console that shows no open action. Comments and profiles that stay can then be worth keeping, because you control what gets published.
If the cleanup is bigger than an afternoon, or the spam keeps coming back, Web Leveling can look at it with you. Our website security audit checks accounts, plugins, themes and access for anything nobody approved, and we tell you plainly when settings alone will do. We work with small and medium businesses across the country and overseas. Send us what you are seeing on your site and we will tell you where to start.
Terms
Spam cleanup words in this post
Tap a term to see what it means.
User-generated spam. Spammy content added to a site by users through a channel meant for user content, such as comments, forum posts, profiles or uploaded files.
Manual action. A penalty issued after a human reviewer at Google decides pages break its spam policies, shown in Search Console.
rel="ugc". A link attribute that marks a link as part of user-generated content.
nofollow. A link attribute that tells Google not to associate the site with, or crawl, the linked page through that link.
noindex. An instruction that asks search engines to keep a page out of their index.
Request Review. The Search Console button used to ask Google to recheck a site after a manual action has been fixed.
