Spam wastes time and can hurt your reputation. Most of it comes from a few entry points.
1. Turn off comments you do not use
No form, no comment spam.
2. Protect forms without captcha
A hidden field, a time check and a rate limit stop most bots.
3. Limit login attempts
Bots trying passwords are locked out after a few attempts.
4. Control registrations
Only allow accounts where you need them, such as checkout.
5. Close pingbacks
Few sites use them; spammers do.
See Disably, Contactly and Lockly, and how to disable comments completely.
Frequently asked questions
Is a captcha needed?
Usually not; invisible checks stop most bots.
Why do I get spam registrations?
Open registration attracts bots; turn it off if unused.
Do pingbacks matter for SEO?
No, they are mostly used by spammers.