Akismet

Akismet works by sending each comment somewhere else to be judged. The plugin transmits the comment, the commenter's name, email address, IP address and user agent to a hosted service, which returns a verdict. Everything good and everything questionable about Akismet follows from that design.

The filtering is genuinely effective — a service seeing spam across millions of sites recognises campaigns your site is seeing for the first time. The cost is that your visitors' data leaves your site.

What it actually does

• Checks each comment, pingback and trackback against the service.
• Files spam into the spam folder rather than deleting it, so false positives are recoverable.
• Auto-deletes the worst spam after a period, keeping the database from filling up.
• Shows a per-comment history so you can see why something was filed where it was.
• Works with contact form plugins that integrate with it, extending the same filtering to form submissions.

The setup is a single API key. That is the whole configuration, and the near-total absence of settings is a genuine feature.

The privacy question, stated plainly

This is the part that gets skipped, and it has a compliance dimension in several jurisdictions.

Every comment submission sends personal data — name, email, IP address — to a third-party processor outside your site. Practical consequences:

• Your privacy notice must disclose it, naming the service and what is sent.
• You need a lawful basis for the transfer, and depending on where you and your commenters are, a processor agreement.
• Telling commenters at the point of submission is good practice; the plugin can display a notice for this.
• The transfer happens whether or not the comment is spam, because the check is how spam is identified.

None of this makes Akismet unusable — it is used on an enormous number of sites — but "install and forget" is not a complete answer if you have compliance obligations. The related consent tooling question is in cookie consent plugins.

The licence tiers

The distinction that surprises people is that the free tier is for personal, non-commercial sites. A blog running adverts, a business site, or anything selling is expected to be on a paid plan.

That is a definition about the site's purpose rather than its size, and it is easy to drift across without noticing — a hobby blog that adds a shop has changed tier. If you monetise, check which plan applies rather than assuming the free key still fits.

False positives, and why to check

Spam filtering is a probability judgement, and it is occasionally wrong. Real comments do get filed as spam.

Because Akismet quarantines rather than deletes, this is recoverable — but only if someone looks. Check the spam folder periodically, especially on a site where comments matter, and mark false positives as not spam so the correction is fed back.

The reverse also happens: some spam gets through, particularly targeted or hand-written spam that does not match a known campaign.

Alternatives worth knowing

The last row is worth genuine consideration. Many sites carry a comment system that produces almost no legitimate discussion and a permanent moderation obligation. If that describes yours, disabling comments removes the spam problem, the privacy transfer and the maintenance in one action.

Where it fits alongside everything else

Akismet is a comment spam filter. It is not a security plugin and does not pretend to be — it will not stop brute-force login attempts, it does not scan for malware, and it does not patch anything. Those belong to security plugins, two-factor authentication and keeping things updated, in that order of value. The full picture is in the WordPress security checklist.

It is also worth noting what it costs your site technically: an external HTTP request per comment submission. On a site with heavy commenting that is a dependency on someone else's uptime in your comment path.

Common mistakes

• Running the free tier on a commercial site.
• Never opening the spam folder, and losing real comments quietly for months.
• Omitting it from the privacy notice, which is the most common compliance gap around this plugin.
• Treating it as security software.
• Running Akismet and a challenge and a honeypot, three overlapping defences where one and a half would do.

Deciding

If your site has real discussion and you have no constraint on third-party data transfer, Akismet is close to a default and there is little to debate. If you have compliance obligations, disclose the transfer properly or choose a self-hosted filter. And if your comments produce nothing but spam and moderation work, the honest answer may be to turn them off entirely.