Can WP Ghost Prevent Spam Messages and Comment Spam?

Partly. WP Ghost blocks bots that post comments or create accounts through the default WordPress endpoints, but it doesn’t filter what people (or bots) submit through your forms. For contact form spam and message content, use an anti-spam plugin next to WP Ghost.

What WP Ghost does against spam

WP Ghost addresses spam at the bot level in several ways.

Blocks automated comment spam bots. WP Ghost can change the wp-comments-post.php path (Custom comment Path), so bots posting straight to the default comment endpoint get a 404 error. Many spam scripts send their POST requests to that default path without ever loading your page. Comment Form Protection in WP Ghost > Brute Force adds Math reCAPTCHA, Google reCAPTCHA V2 or Google reCAPTCHA V3 to the comment form as well.

Reduces CMS-targeted spam. Some spammers first detect WordPress and plugins like Elementor, WooCommerce or a contact form plugin, then send CMS-specific spam offers. WP Ghost’s path security and Simulate CMS hide the WordPress identity and the plugin names, so these scans can’t confirm what your site runs.

Blocks signup spam bots. Sign Up Form Protection in WP Ghost > Brute Force adds the same CAPTCHA to the registration form, which stops automated sign-ups that create spam accounts.

What WP Ghost does not do

WP Ghost does not filter the content of form submissions. If a person (or a sophisticated bot) fills out your actual comment form or contact form and submits it through the page, WP Ghost does not analyze the message for spam content, check the sender against spam databases, or block the submission based on keywords. This is the job of a dedicated anti-spam plugin.

Contact form plugins like WPForms, Contact Form 7, Gravity Forms, and Ninja Forms have their own submission endpoints that are separate from WordPress’s wp-comments-post.php. Changing the comment post path does not affect contact form submissions. WP Ghost has no built-in feature to filter contact form spam.

Recommended anti-spam setup

For spam protection on both layers, use WP Ghost for the bot level and a dedicated anti-spam plugin for the content level. Akismet or Antispam Bee filter comment and form spam by content and spam databases. They don’t overlap with WP Ghost: WP Ghost blocks the bots before they reach the forms, and the anti-spam plugin filters whatever gets through.

For the comment settings, see the Change the Comments Path and Block Comment Spam tutorial. For registration spam, see Will WP Ghost protect my site against spam signups?

Frequently asked questions

Will hiding wp-comments-post.php stop all comment spam?

It stops automated bots that post directly to the default file path. It doesn’t stop spam submitted through the comment form on your page. Adding reCAPTCHA to the comment form in WP Ghost > Brute Force stops more of the remaining bots, and an anti-spam plugin that checks message content handles what’s left.

Does WP Ghost work with Akismet or Antispam Bee?

Yes. These anti-spam plugins analyze submission content, which is a different layer from WP Ghost’s bot blocking. There is no feature overlap and no configuration conflict. WP Ghost blocks the bots, and the anti-spam plugin filters the content. See the compatible plugins list for details.

Can WP Ghost stop spam on WooCommerce product reviews?

WooCommerce product reviews use the same wp-comments-post.php endpoint as standard WordPress comments. WP Ghost’s path change and reCAPTCHA protection apply to WooCommerce reviews the same way they apply to regular comments.

Does WP Ghost modify WordPress core files?

No. WP Ghost uses rewrite rules and WordPress filters. No core files are modified. The comment endpoint path change is handled through server rewrite rules, not by modifying the actual wp-comments-post.php file.