Short answer
WordPress has keyword moderation built in. Under Settings, Discussion, the Comment Moderation box holds matching comments for review, and the Disallowed Comment Keys box sends matching comments to the trash. Both match inside words and check the comment's text, name, email, URL, IP address and browser string. Combine them with the link limit and a spam plugin, and embed X posts one at a time from their URLs.
Key takeaways
- Comment Moderation holds; Disallowed Comment Keys trashes.
- Both lists match inside words, so short entries cause false positives.
- The default holds comments with two or more links, a good spam filter on its own.
- Embed X posts by pasting the URL on its own line or using a Custom HTML block.
Where are WordPress's moderation settings?
In the dashboard under Settings, then Discussion; the keyword lists are near the bottom of the page.
| Setting | What it does | Suggested |
|---|---|---|
| Comment must be manually approved | Every comment waits for you | On for small sites, off with good lists |
| Comment author must have a previously approved comment | Regulars skip the queue | On |
| Hold a comment if it contains N or more links | Link-heavy comments wait | Keep the default of 2, or set 1 |
| Comment Moderation (list) | Matching comments are held | Your "hold" words |
| Disallowed Comment Keys (list) | Matching comments go to trash | Your "reject" words |
How do the keyword lists match?
One entry per line, matched inside words, against the comment's text, author name, email, URL, IP address and browser user agent.
That inside-words matching is the main trap. WordPress's own help text points out that "press" would match "WordPress". So ass in Disallowed Comment Keys silently trashes every comment containing "class" or "passion". Keep entries long and specific: phrases, full spam domains, email patterns.
Before you paste a list in, test it in the filter tester with "Match inside longer words" switched on. That mimics WordPress's behavior, so every false positive it shows you is one WordPress would make too.
What should go in each list?
Put clear spam and abuse in Disallowed Comment Keys, and put anything context-dependent in Comment Moderation.
Disallowed Comment Keys (trash):
free followers
seed phrase
casino bonus
spamdomain.example
Comment Moderation (hold):
bit.ly
tinyurl
crypto
giveaway
The rule builder exports both lists from one rule set: reject rules go to the disallowed list, hold rules to the moderation list.
How do I embed X posts in WordPress?
Paste the post URL on its own line in the block editor, or use a Custom HTML block with cleaned embed code.
WordPress supports embedding from X links through oEmbed, so a URL on its own line usually turns into an embed. If you want control over the code, for privacy options like do-not-track, run it through the embed cleaner and paste the result into a Custom HTML block. Themes that load widgets.js globally only need the blockquote.
What about feeds of posts on a WordPress page?
Use a plugin or service that has its own approval queue, and load your rules into it; never pipe an unmoderated hashtag onto a page.
Social feed plugins vary a lot in how much moderation they offer. Look for an approval queue, keyword filters, and per-account allow and block lists. If a plugin can only filter by keyword, export your rules as a plain list and paste them in.
Common questions
What happened to the WordPress comment blacklist?
WordPress 5.5 renamed the "Comment Blacklist" setting to "Disallowed Comment Keys". It works the same way.
Do I still need a spam plugin?
For any site that gets real traffic, yes. Keyword lists catch what you've seen before; a spam service compares comments against patterns across many sites. Keep both.
Can WordPress moderate the X posts I embed?
No. Embeds aren't comments, so the discussion settings don't apply. You moderate embeds by choosing which posts to embed.