Blog Comment Spam: Google Says It’s Your Problem Now

Somewhere on a small business website right now there’s a blog post from 2018 with 412 comments. Not one of them is from a human. They’re all some version of “Very informative article, I will visit again” followed by a link to a casino in a country you can’t find on a map.

On October 26, Google updated its help page on preventing user-generated spam, and it’s a good excuse to go look at what your website lets strangers publish under your name.

The short version

• Google refreshed its guidance on user-generated spam and now calls out tools that let people publish shared pages, generated content or web apps.
• If strangers can post on your site (comments, reviews, a quote tool that makes shareable pages), Google treats what they post as part of your site.
• Turn on comment moderation, mark visitor links as ugc or nofollow, keep throwaway pages out of search, and verify your site in Search Console so you hear about problems first.

What did Google actually change?

Google added wording that covers more than comment boxes. Its page on preventing abuse now says that hosting platforms and tools that let users publish shared pages, generated content or web apps “may be similarly open to abuse.” Search Engine Roundtable spotted the update the same day.

There’s also a new section called “Only index content meant for Search.” The idea is simple: if your site lets people create a shareable page or a generated result, ask whether that page should ever show up on Google. Most of the time the answer is no, and Google suggests a noindex tag or a robots.txt block by default.

You can read the whole thing on Google Search Central. It’s short. Shorter than most cookie banners.

Does this matter if I just have a small business website?

Yes, if anything on your site lets a stranger type something that ends up on a public page. That’s more sites than people think.

The obvious one is blog comments. WordPress ships with them turned on, and plenty of sites were built, launched and then left alone like a rental car at the airport. The comment box kept working the whole time. Spammers love that.

The less obvious ones are the new toys. A “build your quote” calculator that makes a page with its own link. A review widget that posts straight to the site. A little AI tool someone bolted on that spits out a results page for every visitor. Each one of those can quietly create hundreds of pages that Google can crawl, and you never wrote a single word of them.

I see this all the time on sites I’m asked to clean up: the business owner has no idea the comments section exists, and Google has been reading it for years.

Why does spam in my comments hurt my site?

Because Google can’t tell who typed it. To a search engine, a page on your domain is your page, and the junk on it counts against you.

Spam comments are full of links to sketchy places, and links say “I vouch for this.” Your bakery is now vouching for a pill shop. That’s not a great look, and in bad cases it can lead to a manual action, which is Google’s polite way of saying it’s taken your site off the good list. I wrote about what that’s like in my post on Google manual actions, and trust me, it’s a pain in the ass to undo.

There’s also the human side. A customer scrolls to the bottom of your post about kitchen remodels and finds forty comments selling crypto. They don’t think “spammers.” They think “this place isn’t paying attention.” Fair enough, honestly.

How do I stop comment spam on WordPress?

Start by deciding if you even want comments. Most small business blogs don’t get real ones, and the real conversations happen on Facebook or in the inbox anyway. If that’s you, turn comments off in Settings, then Discussion, and close them on old posts too.

If you do want them, do these and you’ll be in decent shape:

• Turn on “Comment must be manually approved.” Google itself points out that comment moderation is built into most website platforms. Use the damn thing.
• Make sure links in comments get the ugc or nofollow tag. That tells Google you’re not vouching for them. WordPress does this for comments by default, but custom setups and some plugins don’t, so check.
• Add a spam filter and block automated sign-ups if your site has user accounts.
• Delete the backlog. The 412 casino comments from 2018 aren’t going to moderate themselves (believe me, I’ve waited).

What about quote tools, calculators and AI features?

This is the part of the update I’d pay attention to, because it’s where small sites are heading. Everybody wants a calculator, a “see your price” tool or an AI helper now. Great. Just don’t let every result become its own public page that Google indexes.

Google’s suggestion is to keep those pages out of search by default with a noindex tag, and only let in what’s actually meant to be found. A visitor’s personal quote for a 12-by-14 deck doesn’t need to rank. It needs to get to them, and to you.

Google also suggests watching your Page Indexing report in Search Console for sudden spikes. If your 30-page site suddenly has 3,000 indexed pages, something is making pages behind your back. That’s not growth. That’s a leak.

When I build tools like these for clients, the shareable pages are noindexed from day one. It’s a five-minute decision that saves a half-assed cleanup later.

Questions people ask

Should a small business blog allow comments at all?

Only if you’ll moderate them. A comment section nobody checks is just a public bulletin board for spammers. If the real talk happens on social or by email, turning comments off costs you nothing.

Will Google penalize me for old spam comments?

It can count against the pages they’re on, and heavy spam can lead to a manual action. Deleting the junk and moderating going forward is the fix. Verify your site in Search Console so you get an email if Google ever flags something.

What does a noindex tag do?

It tells search engines not to show a page in results. The page still works for anyone with the link. It’s the right setting for things like personal quotes, shared results and thank you pages.

The cleanup is cheap. Ignoring it isn’t.

None of this is fancy. It’s the website version of checking the mailbox. But Google just put it in writing again: what strangers publish on your site is your problem, and the robots are reading all of it.

If you’d rather not spend a Saturday deleting casino links, this is the kind of thing I handle in my website care work. Tell me what your site’s doing on my start a project page and I’ll take a look.