"User-generated spam" manual action: comments, forums and profiles

What the reviewer found

Google's list of signs is specific: posts or profiles that look like ads, out-of-context links, usernames that are not real names and link to unrelated sites, and text that looks machine-written. On WordPress, look at:

• Comments approved automatically or in bulk, especially on old posts that still accept them.
• Pingbacks and trackbacks, which are often nothing more than a link.
• Forum plugins (bbPress, wpForo and similar) where anyone can register and post.
• Member profiles from BuddyPress, membership or LMS plugins, where the bio and website fields are public pages.
• Review sections in WooCommerce that accept reviews from anyone.

Search Google with site:yourdomain.com plus commercial or adult terms unrelated to your topic to find what is indexed. Server logs help too: Google suggests watching for sudden traffic to newly created pages and URLs containing keywords that have nothing to do with your site.

Why it matters beyond the notice

The action itself is contained, but Google's help page is clear that spam left on a site affects more than the flagged pages. It makes the site worse for real visitors, and a site where most indexed pages are bot posts is judged by what those pages look like. Spam threads also tend to attract more spam, because bots find each other's footprints.

There is a security angle too. Profiles and forum posts often carry links to phishing or malware pages, and a site that links to harmful downloads can end up with a separate entry in the Security issues report; see links to harmful downloads. Cleaning user content promptly heads off both problems.

Clearing the backlog

WP-CLI clears comment spam far faster than the admin screen:

wp comment list --status=approve --fields=comment_ID,comment_author,comment_author_url --number=200
wp comment delete $(wp comment list --status=spam --format=ids) --force
wp comment delete $(wp comment list --status=approve --search='casino' --format=ids) --force
# Spam registrations with no posts
wp user list --role=subscriber --fields=ID,user_login,user_url,user_registered

For forums, delete spam topics and the accounts that created them rather than only the posts, or the same accounts return. Remove profile pages of spam users so the URLs return 404. Review the example URLs in the Search Console message, then work outward to similar pages.

Settings that stop it coming back

Under Settings → Discussion:

• Turn on Comment author must have a previously approved comment, or hold all comments for moderation.
• Set Hold a comment in the queue if it contains 1 or 2 links.
• Add common spam terms to Disallowed Comment Keys.
• Consider Automatically close comments on articles older than a set number of days.
• Turn off pingbacks and trackbacks for new posts if you do not use them.

Under Settings → General, uncheck Anyone can register unless registration is essential. If you run a forum, add a spam-filtering service and require email confirmation. WordPress core already adds rel="nofollow ugc" to links in comments, which removes the ranking incentive for comment links but does not stop the spam from appearing on your pages; see sponsored and UGC links.

Hydrogen SEO sets author archives to noindex, follow, so spam author pages created by registrations stay out of the index by default. Member profiles from other plugins use their own post types or URLs; check whether they are indexable and set them to noindex under Hydrogen SEO → Robots if they add nothing for searchers.

Filing while the spam keeps trying

When the spam is gone and the controls are in place, select Request Review. Say what you removed, how many, and what now prevents new spam:

Our bbPress forum allowed open registration without moderation.
We deleted 3,400 spam topics and 1,150 spam accounts, closed
registration to invited members, and hold first posts for approval.
Blog comments now require moderation and allow at most one link.

Google's advice for this action is to keep monitoring and cleaning while you wait. Reviews take days to weeks, and you will hear the outcome by email. If fresh spam appears between your request and the review, it can count against you, so check the moderation queue daily until the decision arrives.