WordPress enables comments, pingbacks, and trackbacks by default. If you don't use comments, or if you're getting hammered by spam, disabling them reduces spam, improves security, and saves server resources. This guide covers how to turn them off globally, on existing posts, and at the server level.
Disable Everything in 3 Steps
- Settings > Discussion > uncheck all boxes under "Default post settings"
- Bulk edit existing posts to disable comments (see Section 2)
- Block xmlrpc.php to stop pingback spam (see Section 3)
01. Disable Comments on New Posts
- Go to Settings > Discussion in WordPress admin
- Uncheck these boxes:
- "Attempt to notify any blogs linked to from the post"
- "Allow link notifications from other blogs (pingbacks and trackbacks)"
- "Allow people to submit comments on new posts"
- Click Save Changes
This only affects new posts going forward. Existing posts retain their individual comment settings.
02. Disable Comments on Existing Posts
- Go to Posts > All Posts
- Select all posts - check the top checkbox to select all on the page. If you have many posts, change "Screen Options" to show more per page
- Choose "Edit" from the Bulk Actions dropdown and click Apply
- Set Comments to "Do not allow"
- Set Pings to "Do not allow"
- Click Update
Repeat for Pages (Pages > All Pages) if needed. For sites with hundreds of posts, a plugin like "Disable Comments" by developer developer can turn off comments globally with one click.
03. Disable Pingbacks and Trackbacks
Pingbacks and trackbacks are a WordPress feature that notifies other blogs when you link to them (and vice versa). In practice, they're almost exclusively used for spam. Disabling them in Settings > Discussion (Section 1) stops WordPress from processing new ones, but spammers can still send pingback requests to xmlrpc.php.
Block xmlrpc.php (Recommended)
If you don't use the WordPress mobile app, Jetpack, or any service that requires XML-RPC, you can block it entirely in .htaccess:
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>This stops all pingback spam at the server level before WordPress even processes it, saving CPU and database load. See our .htaccess guide for more.
If you use the WordPress mobile app or Jetpack, blocking xmlrpc.php will break them. In that case, leave xmlrpc.php accessible and just disable pingbacks in Settings > Discussion. See our Jetpack guide for more on this.
04. Dealing With Comment Spam
If you want to keep comments enabled but reduce spam:
- Akismet - comes pre-installed with WordPress, catches the majority of spam comments automatically
- Require manual approval - Settings > Discussion > "Comment must be manually approved"
- Close comments on old posts - Settings > Discussion > "Automatically close comments on posts older than X days"
- Require registration - Settings > Discussion > "Users must be registered and logged in to comment"
For WordPress security beyond comments, see our WordPress Security Guide.
Comment Spam Overwhelming Your Site?
If spam comments are causing resource limit errors or filling your database, open a ticket. We can help clean up the database and block the spam sources.
Open a Support TicketFrequently Asked Questions
How do I disable comments on new WordPress posts?
In your WordPress dashboard go to Settings then Discussion and uncheck Allow people to submit comments on new posts. This turns comments off for posts you publish from then on; existing posts keep their current setting.
How do I turn off comments on existing posts?
Open the Posts list, use bulk edit to select the posts, and set Comments to Do not allow, or disable them per post in the editor. This clears comments from content that was published before you changed the global setting.
How do I stop pingbacks and trackbacks?
In Settings then Discussion, uncheck Allow link notifications from other blogs (pingbacks and trackbacks). Disabling XML-RPC also removes a common pingback-spam and amplification vector, which improves security and reduces load.
Does disabling comments improve security and performance?
Yes. Turning off comments and pingbacks removes a major spam target, cuts the database writes and server work spam generates, and closes the XML-RPC pingback abuse path. If you do not use comments, disabling them is a clear win.
Quick Recap
- Settings > Discussion - uncheck all three default post settings
- Bulk edit existing posts - set Comments and Pings to "Do not allow"
- Block xmlrpc.php - in .htaccess to stop pingback spam at the server level
- Keep Akismet active - if you leave comments enabled
- Close comments on old posts - to reduce the spam surface area
Last updated November 2026 · Browse all WordPress articles
