How to Disable WordPress Comments Pingbacks and Trackbacks

WordPress enables comments, pingbacks, and trackbacks by default. If you don't use comments, or if you're getting hammered by spam, disabling them reduces spam, improves security, and saves server resources. This guide covers how to turn them off globally, on existing posts, and at the server level.

01. Disable Comments on New Posts

1. Go to Settings > Discussion in WordPress admin
2. Uncheck these boxes:
   • "Attempt to notify any blogs linked to from the post"
   • "Allow link notifications from other blogs (pingbacks and trackbacks)"
   • "Allow people to submit comments on new posts"
3. Click Save Changes

This only affects new posts going forward. Existing posts retain their individual comment settings.

02. Disable Comments on Existing Posts

1. Go to Posts > All Posts
2. Select all posts - check the top checkbox to select all on the page. If you have many posts, change "Screen Options" to show more per page
3. Choose "Edit" from the Bulk Actions dropdown and click Apply
4. Set Comments to "Do not allow"
5. Set Pings to "Do not allow"
6. Click Update

Repeat for Pages (Pages > All Pages) if needed. For sites with hundreds of posts, a plugin like "Disable Comments" by developer developer can turn off comments globally with one click.

03. Disable Pingbacks and Trackbacks

Pingbacks and trackbacks are a WordPress feature that notifies other blogs when you link to them (and vice versa). In practice, they're almost exclusively used for spam. Disabling them in Settings > Discussion (Section 1) stops WordPress from processing new ones, but spammers can still send pingback requests to xmlrpc.php.

Block xmlrpc.php (Recommended)

If you don't use the WordPress mobile app, Jetpack, or any service that requires XML-RPC, you can block it entirely in .htaccess:

<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

This stops all pingback spam at the server level before WordPress even processes it, saving CPU and database load. See our .htaccess guide for more.

04. Dealing With Comment Spam

If you want to keep comments enabled but reduce spam:

• Akismet - comes pre-installed with WordPress, catches the majority of spam comments automatically
• Require manual approval - Settings > Discussion > "Comment must be manually approved"
• Close comments on old posts - Settings > Discussion > "Automatically close comments on posts older than X days"
• Require registration - Settings > Discussion > "Users must be registered and logged in to comment"

For WordPress security beyond comments, see our WordPress Security Guide.

Quick Recap

1. Settings > Discussion - uncheck all three default post settings
2. Bulk edit existing posts - set Comments and Pings to "Do not allow"
3. Block xmlrpc.php - in .htaccess to stop pingback spam at the server level
4. Keep Akismet active - if you leave comments enabled
5. Close comments on old posts - to reduce the spam surface area

Last updated March 2026 · Browse all WordPress articles