Akismet
by Automattic
Comment spam protection. Free for personal use, paid for commercial. Default-installed on most WordPress sites.
- Lighthouse
- 98 / 100 Tested May 30, 2026
- Accessibility
- WCAG untested
- Open CVEs
- 0
- Last release
- April 30, 2026 v5.4
- WP.org rating
- 4.7
Akismet is the default comment spam protection plugin for WordPress, bundled with every default WordPress install since 2005. Free for personal sites; paid tiers for commercial use. Maintained by Automattic. Effectively a managed cloud spam filter as a plugin, with API-based filtering and a substantial training dataset.
Pros
- Bundled with WordPress by default, near-universal install base
- Free tier covers personal sites and small blogs
- Maintained by Automattic with sustained engineering investment
- API-based filtering scales without local computation
Cons
- Commercial use requires a paid plan
- Cloud-based filtering means comment metadata is sent to Akismet servers
- Alternative spam plugins (Antispam Bee, CleanTalk) exist with different privacy postures
Pick Akismet when you want the default-bundled comment spam protection and you are on a personal site (free) or you are okay with the commercial-use pricing.
Avoid if you have strict data residency or privacy requirements that conflict with sending comment metadata to Akismet's cloud servers (look at Antispam Bee or self-hosted alternatives).
Frequently asked questions
- Is Akismet free?
- Free for personal sites. Commercial use requires a paid plan starting at $11/month. Akismet uses an API-based filter, which is what differentiates it from purely local-rule spam plugins.
- Why is Akismet bundled with WordPress?
- Akismet ships with every default WordPress install because it's maintained by Automattic and the WordPress Foundation. Activating it requires a (free) Akismet API key from akismet.com.
- Akismet vs Antispam Bee?
- Akismet uses cloud-based filtering (data is sent to Akismet's servers). Antispam Bee runs entirely locally (no third-party data sharing). Privacy-sensitive sites often prefer Antispam Bee; sites that want the most-trained spam corpus pick Akismet.
- Does Akismet send my data to third parties?
- Yes. Akismet sends comment author name, email, IP, user agent, and comment body to its filtering API. This is documented and required for the cloud filter to work. Privacy disclosures should reflect this when running on EU-facing sites.
Recent releases
- v5.4 April 30, 2026
Filter performance optimization, WordPress 6.8 compatibility
- v5.3.5 March 12, 2026
Patch release
- v5.3.4 February 8, 2026
Maintenance release
- v5.3.3 January 15, 2026
Bug fix for stats dashboard
- v5.3.2 December 4, 2025
Patch release
- v5.3.1 November 10, 2025
Maintenance release
- v5.3 October 15, 2025
Refreshed admin UI
- v5.2.3 September 22, 2025
Patch release
-
Sucuri Security
Free auditing, malware scanning, and hardening — paired with a paid cloud WAF that filters traffic before it reaches WordPress.
-
All-In-One Security (AIOS)
The most-installed free WordPress firewall and hardening plugin. Genuinely capable free tier from the UpdraftPlus team.
-
Wordfence
Endpoint firewall and malware scanner for WordPress. Free core, paid threat intelligence feeds.
-
Kadence Security
Login hardening, two-factor auth, and brute-force protection — the plugin formerly known as iThemes Security, then Solid Security.
Performance testing
Tested on Kinsta Starter (Google Cloud C3D, Iowa). Configuration: Akismet active, default WordPress install, mobile, 4G simulated, cold cache. 5 runs, median reported. Raw Lighthouse JSON downloadable on request.
Vulnerability tracking
Open and recently closed CVE counts pulled from Patchstack and Wordfence Intelligence on every build. Last disclosure date reflects the most recent public CVE for this plugin, not necessarily the most recent vendor patch.