WordPress spam comment cleanup.

§ 01 — MECHANISM

If Akismet didn’t see it, Akismet can’t stop it.

Normal spam goes through the comment form, where Akismet and similar plugins can score it. Injected spam skips the form entirely — it’s either written into wp_comments via a vulnerable plugin or appended to post content via stolen credentials.

Both cases need cleanup at the database level. I remove the spam without touching legitimate comments, find the route the attacker used, and harden it so Akismet’s job becomes possible again.

01 SELECT comment_ID, comment_author, comment_date
02   FROM wp_comments
03  WHERE comment_approved = 1
04    AND comment_author_url LIKE '%http%'
05  ORDER BY comment_date DESC LIMIT 50;
06
07 // A burst of auto-approved comments with outbound URLs,
08 // during hours your site is normally quiet — investigate.

§ 02 — WHAT WE REMOVE

Every comment, every post, every link.

• [ TRIAGE ]

  Database scanned for comments that don’t match your moderation rules — auto-approved with links, posted in bursts, attached to closed-comment posts.

• [ COMMENTS ]

  Injected comments removed in bulk. Legitimate comments preserved. Pingbacks reviewed.

• [ POSTS ]

  Post content scanned for spam links injected directly into the body. Removed, originals kept.

• [ DATABASE ]

  wp_commentmeta, wp_postmeta, and related tables audited for hidden persistence.

• [ HARDENING ]

  Comment endpoints rate-limited. Akismet and Recent Comments plugins audited. Plugin vulnerabilities patched.

• [ REPORT ]

  Plain-English forensic write-up, count of comments removed, what to do before re-opening comments.

§ PRICE

Flat $279. One-time. Per site.