Spam Free WordPress comment spam plugin blocks 100% of the automated spam with zero false positives, and with no CAPTCHA.

This plugin was born out of necessity in September of 2007. A comment spam fighting plugin was needed that could handle huge visitor traffic, and huge spam attacks. Today the plugin can scale to handle any amount of comment spam on the highest traffic blogs.
Spam Free WordPress Features
- Automatically blocks 100% of automated comment spam
- Local manual spam and ban policy set with local IP address blocklist
- Significantly reduces database load compared to other spam plugins
- Zero false positives
- Option to strip HTML from comments
- No CAPTCHA
- Saves time and money by eliminating the need to empty the comment spam folder
- Option to automatically delete comments marked as spam, trackbacks/pingbacks, and unapproved.
- Hundreds of thousands of Spam Free Blogs and Counting!
The plugin has the option to generate a custom comment list and comment form for themes that do not work automatically with the plugin.
Comment spam damages a blog’s SEO ranking. This plugin preserves your Search Engine Optimization.
The comment form is secured in the background, so your readers just see your comment form.
Automatically Blocks Automated Comment Spam
Spam Free WordPress several security methods to block spam bots, while allowing real readers to leave a comment without any problem. All security is pass or fail, which means a real person can leave a comment, but a bot cannot. There are no filters to try to guess what is a legitimate comment, ham, or spam.
Local Blocklist
Spam Free WordPress uses an IP address blocklist to block comment spam that is manually submitted by a real person. The blocklist can also be used to ban readers that leave offensive comments. The local blocklist is stored in the database, so it can be used to set policy for a local blog. If someone has their IP address listed in the blocklist that person can still read the blog, but will not be able to leave a comment.
Reduces Database Load
Comments that are blocked are never written to the database, which eliminates all the load on the database that spam creates, and other plugins allow. Blocked comments are sent to an error page that allows the reader to return to their comment, without a loss of data, to try to correct the error. Comments that are blocked have failed security methods that only spam bots would fail.
Option to Strip HTML from Comments
It is very common for manual and automated comment spam to include a URL that links to a web site. Spam Free WordPress has an optional feature that will automatically strip out HTML from comments, so URL links show up as plain text, and will also remove the allowed HTML tags from below the comment text box.
Pingbacks and Trackbacks
The plugin will close pingbacks and trackbacks on all posts and pages automatically when the plugin is installed, and it also has an option to open pingbacks again if so desired.
JetPack Comments
JetPack has introduced a Comments module that takes over the comment form. Spam Free WordPress disables the JetPack Comments module because it doesn’t work with any other plugin that manages the comment form. Spam Free WordPress plays nice with all plugins.
Spam Free WordPress in Action

Comment Form Example
The comment form is secured in the background, so your readers just see your comment form.

Spam protection is invisible to the reader.
Installation Instructions
1. Upload to the /wp-content/plugins directory
2. Activate
3. Turn on the Spam Stats, and try to leave a comment to make sure it is working.
Support
Spam Free WordPress requires a free license key for support, and to activate advanced features, that you can get here.
Requirements
Self-hosted WordPress 3.1 or above. PHP 5 or above. Works with single-site, or multi-site, versions of WordPress.
Download
Download latest version of Spam Free WordPress
Troubleshooting version 1.9.3
Error Messages
Here’s what to do if the plugin displays an error message:
- Error message:
- “Spam Free WordPress disabled the comment form because it could not retrieve the password from the server. It may be necessary to do one, or all, of the following. Turn on the Old Password Fields option, turn off Nonce Security, or to turn on Generate Comment Form.”
- Solution:
- It may be necessary to do one, or all, of the following. Turn on the Old Password Fields option, turn off Nonce Security, or to turn on Generate Comment Form.
- Error message:
- “Spam Free WordPress nonce security check failed. Troubleshooting.”
- Solution:
- Uncheck the box next to Nonce Security.
- Error message:
- “Spam Free WordPress could not retrieve the password from the server. It may be necessary to do one, or all, of the following. Turn on the Old Password Fields option, turn off Nonce Security, or to turn on Generate Comment Form. Troubleshooting.”
- Solution:
- It may be necessary to do one, or all, of the following. Turn on the Old Password Fields option, turn off Nonce Security, or to turn on Generate Comment Form.
- Error message:
- “Comment blocked by Spam Free WordPress because your IP address is in the local blocklist, or you forgot to type a comment.”
- Solution:
- Either your IP address is in the plugin blocklist, which can be found under Settings >> Spam Free WordPress, or you did not type in a comment.
- If All Else Fails
- Switch themes.
- Disable all plugins until the problem plugin is found.
- Request help with the Spam Free WordPress support request form (must have a free license key, and must be logged in to use).
Comment form and Comment List Are Not Styled Properly
- Uncheck the Generate Comment Form box. If you then get an error message when leaving a comment, turn the Generate Comment Form option back on, because your theme isn’t working properly. The Generate Comment Form option that displays the comment list and comment form has a CSS style sheet that can be found in the plugin’s css folder where you can make changes. Be aware however, that css folder will be overwritten on plugin updates.
Plugins That Cause Problems
- Minify plugins such as WP Minify, Better WordPress Minify, W3 Total Cache etc. may need to have minification of JS files turned off, or you can have the plugin exclude the file: sfw-ipwd.js. Some minify plugins, like Better WordPress Minify, require a script handle rather than a filename, so the script handles that should be excluded are: sfw_ipwd. All of the Spam Free WordPress JavaScript files are already minified, or more correctly, compressed.
- Minify plugins can prevent JavaScript files from loading, or from loading properly.
Incompatible Plugins
- Disqus Comment System – Since it takes over your comments completely
- JetPack Comments module – Since it takes over your comments completely
Languages Supported
- English
- German – Deutsch (de_DE)
- Italian – Italian (it_IT)
- French – Français (fr_FR)
- Hebrew – עברית (he_IL)
- Japanese – (日本語 – ja)
- Chinese – 中文 (zh_CN)
- Hong Kong – (香港) (zh_HK)
- Taiwan – (台灣) (zh_TW)
- Swedish – Svenska (sv_SE)
- Norwegian – (norsk)
Free License Key Required
Spam Free WordPress requires a free license key for support, and to activate advanced features, that you can get here.
Hi, the only way this seems to work is if I have:
-comment form stats on
-automatically generate form on
-invisible password
I don’t want to automatically generate the form, it doesn’t match the style of the site, but if I turn that off I can’t get comments through. peacesweets.com is the site.
I note that you mention that I can use css to style the form with the automatic generate feature on, that sounds like something that might solve the problem, but I’d appreciate any input you may have on the issue.
Thanks
View the source of the page with a few comments on it. Then use the id and class tags you see to style the comments how you want them to look in your style.css file, or whichever CSS file you want to use. (8:28 am on August 19, 2012)
Spam-free-wordpress doesn’t work on my website anymore after updating to the latest 1.7.8.2. The error message is always saying that “the comments were blocked by spam free wordpress because the password is incorrect or blank”
There’s always a “” in front of the password (when using either click password field or button options). Could this be the reason? How do I solve this. My website is maestrochworld.com.
It appears that one of the plugins you have installed is outputting extra characters in the password field. The AJAX communication is supposed to only be between my plugin, and WordPress, but it appears another plugin is improperly interfering with that communication. To find out which one disable them one by one, while checked the password each time. I would start with the User Access Manager plugin. (11:50 am on August 18, 2012)
Yes, there was one other plugin that interfered with spam free. It was WP Easy Embed.
Thanks for the advice, my problem has been solved!
Please disregard my previous comment. I turned off Automatically Generate Comment Form and everything is fine.
Installed the latest 1.7.8.2, and it broke the comments section formatting and everything that comes after (sidebar, etc.)
My site: www.freewaregenius.com
Hi, just want to tell that the latest update ruins my CSS and AJAX….
Try turning off Automatically Generate Comment Form. I’m not sure what the problem with your AJAX would be without some detail or a link to your blog. If you’re running WP Minify that could cause a problem, for which I have a solution. (10:26 am on August 17, 2012)
Oops… sorry, nevermind. Thats because I activated the “automatically generate the comment form”… It works well now. Thanks
Is there flexibility in how the screen looks? We have 5 different fields: Name, Email, a dropdown menu for location, comment box, How did you hear about us comment box.
The invisible password: is this really an ip blocker?
The password is a password, not an IP blocker.
Right now the look is built-in, but you can turn off the Automatically Generate Comment Form to customize. (10:19 am on August 17, 2012)
When I updated to 1.7.8.2 this morning, my comments ceased to be nested. Now they’re not only all one on top of the other, the text is shoved all the way to the left of the comment box edge. I logged out as admin and the password box is there and everything looks normal except for the non-nesting of comments.
I’m using the Genesis framework, Lifestyle theme, if that helps at all. I haven’t made any changes to the plug-in as it came installed and don’t care to.
link to blog is basiasbookshelf.com if you want to see what it looks like.
Try turning off Automatically Generate Comment Form, and see how it looks. (10:20 am on August 17, 2012)
It works perfectly! Thank you so much.
Does this work for customized event signup pages? What would be the coding and where would it be inserted?
If the page has a comment form, like the one used for single post pages, then yes, otherwise, no. (9:29 pm on August 16, 2012)
All ok, it seems with 1.7.8
I have been getting a lot of comments blocked message while testing.
I finally realized that I am getting these error messages because I am typing a few letters fast and submitting fast (just for testing). When I slowed down and gave it some time, it worked flawlessly.
The problem here is the message is wrong. It should ask me to slow down, and not say my ip is in the ban list or I did not type any comment. And when I press “Back”, it will still give me an error even if I wait, because I guess it did not detect me typing anything (because I already typed the comment earlier earlier)
One request, if you have time. It would be nice if the error message just pops out in the same window, without leaving the comments screen. Just a thought …
Thanks
Some servers respond with the security information for the comment form slower than others. I will try to come up with something to cause the reader to wait to submit the comment until all the security information is loaded. (12:56 pm on August 15, 2012)
Hi Todd. Well, I had some issues with my site that my SP fixed. Apparently some PHP stuff. Now I have a error line right on my site. You can see it on there now: www.veryculinary.com.
I’m pretty lost as to what to do here. Wondering if you can help? We have used SFW for a while with great success, so I’d love to keep it going.
A function was removed in 1.7.7, and a legacy reference to it was not added to prevent this sort of error. This will be fixed in 1.7.8 that will hopefully be out later tonight. (12:49 am on August 15, 2012)
Got the update. Looks good! Question: Does SFW remember IPs so that frequent commenters do not have to enter passwords? The password field is missing, but the comments seem to stick. Screenshot: http://screencast.com/t/ZhQdg2macQDV
The default setting is now for the password to be invisible to the reader. Turn on your spam stats to make sure it is working. (12:53 pm on August 15, 2012)
My site is www.freewaregenius.com. I use a customized Thesis theme, WordPress 3.4.1, and Spam Free WordPress 1.7.7.. The comment form no longer shows the password field, and comments fail ‘an important security check’.
Hoping there is a fix soon!
My site is snixykitchen.com and does the same thing since the update! I have it deactivated right now because I don’t want to block comments to my blog.
If you are using Spam Free WordPress 1.7.7 go to Settings > Spam Free WordPress, then under Use Old jQuery Scripts turn it to On. If this doesn’t fix it try version 1.7.8 coming out hopefully later tonight, and let me know if that fixes it. (12:48 am on August 15, 2012)
If you are using Spam Free WordPress 1.7.7 go to Settings > Spam Free WordPress, then under Use Old jQuery Scripts turn it to On. If this doesn’t fix it try version 1.7.8 coming out hopefully later tonight, and let me know if that fixes it. (12:47 am on August 15, 2012)
After upgrading today I got these errors in my log (posted at the end)
I was also unable to get to any of the sites on my network- including the network admin page. It was the only upgrade I did yesterday. It was the only thing I did yesterday. When I deleted the plugin. Everything came back up.
I then reninstalled it and everything works. The errors in my logs stopped too.
Over 20 of this message-
[13-Aug-2012 19:35:36] PHP Fatal error: Call to undefined function sfw_add_default_pwd_style() in /home2/xxxx/public_html/xxxx/wp-content/plugins/spam-free-wordpress/tl-spam-free-wordpress.php on line 130
I have two multisites and the same thing happened to both sites.
Is the plugin working for you now? (10:09 am on August 14, 2012)
Ya. It was weird. I think that maybe something happened during the upgrade and it got corrupted somehow. It said everything went well, but that is the only thing that makes sense.
Further to earlier comment, I have noticed, since the plugin has been updated, that the theme is picking up the comments template from the parent theme, not the customised version in my child theme. With SFW switched off, it reverts to picking up the child theme comments template.
Go to Settings >> Spam Free WordPress, and turn off Automatically Generate Comment Form.
Can you provide a link to your blog with the plugin turned on so I can take a look? (10:10 am on August 14, 2012)
Thanks, Todd.
I’ve reactivated SFW and turned off automatically generate comment form.
But the following message appears when anyone tries to leave a comment:
Spam Free WordPress rejected your comment because you failed a critical security check.
I tried it myself, and the password field does not display using any of the options provided.
Here is a link with the plugin reactivated: http://since1964.co/i-will-remember-london-2012/
Hope that helps.
If you are using Spam Free WordPress 1.7.7 go to Settings > Spam Free WordPress, then under Use Old jQuery Scripts turn it to On. If this doesn’t fix it try version 1.7.8 coming out hopefully later tonight, and let me know if that fixes it. (12:59 am on August 15, 2012)
The first suggestion using 1.7.7 didn’t change anything. But 1.7.8 fixed it.
Many thanks,
Jeff
I’m happy to hear it is working now. (4:50 am on August 15, 2012)
Guess my theme’s broken too. Comments were working fine before the recent updates, but haven’t done since, not even with V. 1.7.7.
Switching off till I can find a fix.
since1964.co/i-will-remember-london-2012/
The latest versions do not work for me either using a custom child theme of TwentyEleven. I have noticed that when I type into the comment textarea it comes up with request for username and password. I have got my wp-admin folder protected by htaccess. Don’t know if it is anything to do with that. I have tested it on the same theme in a development environment and haven’t had any trouble.
The wp-admin folder should not have any restrictions in the htaccess file, since there is a file in that folder that is used by JavaScript to talk securely to WordPress using AJAX. (10:05 am on August 14, 2012)
FYI to the above comments, the upgrade to 1.7.6 broken my theme also. Stopped scripts from working and broken my navigation and slideshow and so I have had to deactivate. I did not have this problem with the previous version.
Try version 1.7.7, and let me know if it works for you. I didn’t see a comment form when I viewed your blog. (12:51 am on August 14, 2012)
Same thing here. Invisible PW throws and error, saying it’s blank. Click for PW shows nothing, button for PW shows nothing. And now, I’m told my theme is “broken” and to fix it. : I’m invoking the standard comment form in WP v3.4.1 with . What could be more compatible than that?
Are you kidding me!? Only one version available in SVN? People can’t rollback if you keep deleting all previous versions.
Further info on 1.7.6 and 1.7.5: the PW field won’t accept input; even if you knew what the PW was – because it no longer displays anywhere. This used to work flawlessly.
There’s obviously a problem with your theme’s ability to either load the comment form properly, or to load JavaScript properly. The problem can be fixed, but it takes some work. It’s not the plugin, it’s the theme. There are a lot of poorly written themes, unfortunately. http://www.toddlahman.com/spam-free-wordpress-support/
If you want to test to confirm that your theme is the problem, try switching to Twenty Eleven. If your problem goes away then you know it’s your theme that is causing the problem.
Previous versions of the plugin are not available prior to 1.7, because spam bot scripts had learned to bypass the plugin security. (1:15 pm on August 13, 2012)
I like the invisible password, as it is 1 less work for commenters …
Works fine …we will see if it will block spam effectively … it should, I guess :)
Testing Plugin – I don’t see a Password box?
The 1.7.6 version installs with an invisible password box, so you’ll need to leave yourself a test comment to be sure it is working. I would try it myself, but you didn’t provide a link to your blog. (9:29 am on August 13, 2012)
Also tried making password invisible but error message still coming up when try to send comment
When I visited your blog the plugin was not active. Please activate the plugin so I can try a test comment to see what the error message is. Let me know when I can run the test. (9:28 am on August 13, 2012)
Thank you for your reply. I re-activated the plugin. I had temporarily turned it off so I would not miss any comments that were not spam.
It appears your theme is loading an older version of jQuery after WordPress loads the latest version. This is causing a jQuery function the plugin uses to generate the password to stop working because that function was introduced in jQuery 1.7. WordPress uses jQuery 1.72 right now, but your theme is loading jQuery 1.3.2.
If you would like me to fix your theme please visit http://www.toddlahman.com/spam-free-wordpress-support/
Your other option would be to install plugin version 1.7.7, which I will be releasing later tonight, that will load different JavaScripts if someone is using an older version of WordPress, or if that person’s theme loads an older version of jQuery as is the case in your situation. (5:16 pm on August 13, 2012)
Try version 1.7.7, and let me know if it works for you. (1:39 am on August 14, 2012)
I updated to version 1.7.7 and still getting no password or error message when try to send comment.
If you have another suggestion, please give it to me in layman’s terms as I am only maintaining my site and have little knowledge of set-up. If it is something I can not do, I may be able to get my website designer to help me. Thank you, Todd!
I deleted the plug-in and reinstalled it. It is working now. Thank you.
I am very happy the plugin is working for you now. (12:40 am on August 15, 2012)
Updated plugin and password field still not working. Tried both the clicking button option and field option.
It no longer works. Click password and vanishes text but no password appears. Javascript is on. Cookies are on. Worked fine before upgrades. Turning off.
It is your theme that is causing the problem. I didn’t realize how many poorly written themes were available until I made this change to the plugin. I will be releasing version 1.7.6 later tonight that will provide the option to have an invisible password, which means no password field has to be clicked. This should eliminate the issues with poorly written themes.
I appreciate your follow-up Walter, and your patience. (7:41 pm on August 12, 2012)
No password area on the leave comment page. I have paid for support.
I have the exact same problem – latest version of plugin, WP 3.4.1
Was working (click showed the password) prior to this upgrade.
I have the exact same problem. When I just updated the plugin, the “click for password” link doesn’t do anything! Was working before I updated the plugin…
I will be releasing version 1.7.6 later tonight that will provide the option to have an invisible password, which means no password field has to be clicked. Let me know if the new version fixes your issue. (7:44 pm on August 12, 2012)
I will be releasing version 1.7.6 later tonight that will provide the option to have an invisible password, which means no password field has to be clicked. Let me know if the new version fixes your issue. (7:43 pm on August 12, 2012)
I have installed and activated the plugin. When I am logged out of my admin page and try to leave comment on my blog page, the password field is there but when I click on it, it does not insert a password. If proceed without password, I get error message that need one. Any ideas on how to correct this?