How to Filter Inappropriate Content in WordPress

Any WordPress site that accepts input from the public, whether comments, forum posts, profile fields or activity updates, will eventually receive content you do not want published. The answer is a layered setup: WordPress’s built-in moderation settings for the easy cases, a spam service for the volume, a word filter for language, and a reporting workflow for anything a machine cannot judge. This guide walks through each layer in the order we set them up on client sites.

The order matters. Most site owners jump straight to a plugin and skip the free settings that would have caught 80% of the problem. Start with core, add tools only where core falls short.

Layer 1: WordPress’s built-in comment controls

Everything in this section lives under Settings → Discussion. The WordPress documentation on comment moderation covers the mechanics; here is how we actually configure it.

Before a comment appears

Two checkboxes do most of the work. Comment must be manually approved holds every comment for review, which is right for low-volume sites and wrong for anything busy. Comment author must have a previously approved comment is the better default: first-time commenters are reviewed once, regulars publish instantly. We turn on the second and leave the first off on nearly every site.

Comment Moderation

This box has two parts. The first is a link threshold (“Hold a comment in the queue if it contains N or more links”). The default is 2; set it to 1 if you get link-drop spam, since genuine commenters rarely need more than one link. The second is a list of words, names, URLs, email addresses and IP addresses, one per line. A comment matching any line is held for moderation rather than published.

Matching is inside words, so the entry “ass” also catches “class” and “bass”. Put a space or punctuation around short words, or use the moderation list only for terms long enough to be unambiguous. WordPress does not support regular expressions in this box natively, despite what some tutorials claim.

Disallowed Comment Keys

Same format, harsher outcome. A match here sends the comment straight to Trash with no notification. Reserve it for the things you never want to see: casino and pharmacy spam terms, slurs, known spammer domains and IP addresses. Keep anything borderline in the moderation list instead, because a false positive here is deleted before you know it existed.

After editing either list, use the Check past comments against moderation list link under the box. It runs your new rules over existing comments so you can see what would have been caught.

Other settings worth toggling

• Users must be registered and logged in to comment: cuts drive-by spam to almost nothing at the cost of fewer comments. Good for member sites, bad for public blogs.
• Automatically close comments on posts older than N days: old posts attract the most spam. 60 to 90 days is a sensible range for a news-style blog.
• Email me whenever a comment is held for moderation: keep it on if one person moderates; turn it off and check the Comments screen daily if several people do.

Layer 2: Spam detection at scale

Keyword lists do not scale. Spam changes daily and a word list cannot keep up. Akismet (version 5.7.x as of August 2026, 5+ million installs, maintained by Automattic) checks every comment and form submission against a global database and has been accurate enough for years that we install it by reflex.

Pricing is the catch people miss. The Personal plan is free for non-commercial sites only. A business site, a blog with ads, or a store needs a paid plan: Plus starts around $5 a month per site, Pro around $9.95 a month billed annually, with higher tiers for networks. Budget for it; it is still cheaper than an hour of moderation a week.

Enable the discard the worst and most pervasive spam option in Akismet’s settings once you trust it. That stops obvious spam from piling up in the Spam folder at all.

Alternatives if you would rather not pay per site: CleanTalk (paid, per-site), Antispam Bee (free, runs locally, weaker on non-English spam) and honeypot or Turnstile challenges on the comment form. Cloudflare Turnstile is free and far less annoying than reCAPTCHA for real humans.

Layer 3: Filtering language and profanity

Spam tools catch spam. They do not catch a real member swearing at another real member. For that you need a word filter, and there are two approaches.

Replace on display

A plugin such as Content Censor (free on wordpress.org, version 3.2.x, tested up to WordPress 7.0) swaps configured words for asterisks or a replacement string when content is rendered. The original text stays in the database, so editors can see what was actually written and nothing is lost if you later relax the list. This is our preferred approach for comments and bbPress replies.

Block on submit

Some plugins reject the submission outright and show the user an error. This is harsher and tends to make members creative with spelling (a$, sh!t), which your list then misses. Use it only for a short list of slurs where you genuinely do not want the content stored at all.

Doing it in code

If you would rather not add a plugin for a dozen words, a display filter is a few lines in a small custom plugin:

add_filter( 'comment_text', 'wbcom_filter_profanity', 20 );
add_filter( 'bp_get_activity_content_body', 'wbcom_filter_profanity', 20 );

function wbcom_filter_profanity( $text ) {
    $words = array( 'badword1', 'badword2' );
    foreach ( $words as $word ) {
        $pattern = '/\b' . preg_quote( $word, '/' ) . '\b/iu';
        $text    = preg_replace( $pattern, str_repeat( '*', mb_strlen( $word ) ), $text );
    }
    return $text;
}

The \b word boundaries stop “class” from being censored when “ass” is on the list. Hook names differ per content type: comment_text for comments, bp_get_activity_content_body for BuddyPress activity, bbp_get_reply_content for bbPress replies, the_content for posts. Keep the word list in an option so non-developers can edit it.

Layer 4: Community sites need reporting, not just filters

On a membership or community site the problem stops being spam and starts being behaviour: harassment in private messages, offensive avatars, a group created to push a scam. No word list catches an offensive image, and a rule strict enough to catch subtle harassment will also catch normal conversation.

What works is giving members a Report button on everything and giving moderators a single queue. For BuddyPress and BuddyBoss sites we built BuddyPress Moderation Pro for exactly this. Members can flag activity posts and comments, private messages, profiles, groups, avatars and bbPress topics; moderators see every report with the reason and count in one admin screen; and content is hidden automatically once it reaches a report threshold you set (five reports is a reasonable starting point on a mid-size community). Pricing starts at $49 a year for one site.

Whatever tool you use, the workflow should cover:

1. Report: one click, a reason dropdown, optional comment. If reporting takes more than ten seconds, people will not do it.
2. Auto-hide: at N reports, content disappears from public view but is not deleted.
3. Review: a moderator confirms or dismisses. Dismissed reports restore the content; confirmed reports remove it and log a strike against the author.
4. Escalate: repeat offenders are suspended, then banned. Keep the thresholds written down so moderators act consistently.

We covered the wider policy side, including what to put in community guidelines, in our post on AI tools for content moderation, which also compares the automated image and text classifiers available in 2026.

Layer 5: Media uploads

If members can upload avatars, cover images or attachments, text filters are irrelevant. Your options, from cheapest to most thorough:

• Restrict file types. WordPress already blocks executables; tighten it further for members with the upload_mimes filter so only JPEG, PNG and WebP are allowed for avatars.
• Moderate first uploads. Hold the first few uploads from a new member for approval, then trust them.
• Automated image classification. Services such as Sightengine, Amazon Rekognition and Google Cloud Vision SafeSearch return a nudity, violence and gore score per image for a fraction of a cent. Call the API on upload and reject or flag above a threshold. This is a small custom development job, usually a day or two, and worth it on any community over a few thousand members.

A setup that works for most sites

Site type	Core settings	Spam	Language	Reporting
Personal or company blog	Previously approved author; 1-link threshold; close after 90 days	Akismet (free or Plus)	Moderation list only	Not needed
High-traffic publication	Same, plus registered-only on sensitive topics	Akismet Pro + Turnstile	Display filter plugin	Report link per comment
Membership or course site	Registered-only	Akismet or CleanTalk	Display filter on comments and forum	Report button on forum posts
BuddyPress / BuddyBoss community	Registered-only; manual approval of new accounts	Akismet + signup protection	Filter on activity, messages, forum	Full moderation queue with auto-hide

Testing your filters before members do

A filter you have not tested is a filter that either blocks your best commenter or lets everything through. Before going live:

1. Create a subscriber-level test account in a private browser window.
2. Post a clean comment, a comment with two links, a comment with a listed word inside another word (“classic”), and a comment with a disallowed key. Confirm each lands where you expect: published, held, held, trashed.
3. On community sites, repeat for an activity update, a private message and a forum reply. Filters hooked only to comment_text will miss all three.
4. Report the test content from a second account and check the moderator queue and email.
5. Review the moderation list after a month. Anything that has only ever caught false positives should go.

Frequently asked questions

Can I filter inappropriate content in posts written by contributors?

Yes. The same display-filter approach works on the_content, but the better control is editorial: give untrusted writers the Contributor role so their posts need an Editor’s approval before publishing.

Does the moderation list support wildcards or regex?

No. Core does a plain substring match. If you need regex, use a plugin that adds it, or write the filter in code as shown above.

Will a word filter slow the site down?

Not noticeably for lists under a few hundred words. Thousands of patterns run on every comment render can add up; cache the compiled pattern or move filtering to submit time in that case.

Is AI moderation good enough to run unattended?

For nudity detection in images, close to it. For text, current classifiers are good at obvious toxicity and poor at sarcasm, in-group language and context. Use them to prioritise the moderator queue, not to replace it.

Where to start

This afternoon: set “previously approved comment”, drop the link threshold to 1, and fill the Disallowed Comment Keys box with the ten spam terms you are sick of seeing. This week: install and pay for Akismet if the site is commercial. This month: if you run a community, add a report button and a moderation queue so your members help you. Filtering is never finished, but those three steps take care of most of the pain.

If your community has outgrown what plugins can do, our BuddyPress development team builds custom moderation workflows, including image classification on upload and strike systems tied to membership levels.