Akismet Alternative: Spam Protection That Never Leaves Your Site

Akismet ships in every fresh WordPress install, before you've installed your first plugin yourself. And it works: detection rates are good, setup takes two minutes, and your comment section stays clean. There are good reasons why the plugin has been the standard for years.

Two things bother us anyway. First, every comment and every form message leaves your website: the complete text goes to a third-party server for checking, together with the sender's IP address and email address. Second, commercial use requires a paid license, which many people only notice after the first reminder notice. Anyone running a company website on the free tier is operating outside the license terms.

This post sorts through the alternatives, explains how spam protection without the cloud actually works, and names the places where local methods perform worse than cloud services.

All prices are net prices and rough figures, as of mid-August 2026. Providers change their pricing often – check the current pricing page before deciding.

Where Akismet users run into friction

1. Every submission leaves your website

For Akismet to evaluate a comment, it has to know it. So what gets transmitted isn't just a checksum, but the content itself: comment text, name, email address, website field, IP address, user agent, and the page visited. The same applies to contact forms once you enable the Akismet integration. That's technically understandable, since there's no text evaluation without the text. But it means messages someone writes to you in confidence land with a service provider first.

2. Commercial use requires a paid license

Akismet's free tier is meant for personal, non-commercial websites. As soon as a site runs ads, has a shop attached, or simply has a company behind it, usage belongs in a paid tier. The rough figure for a single commercial website is around €120 a year, as of mid-August 2026. That's not an unfair price for a tool that works every day. What's unpleasant is only that many operators don't know the line and experience the bill as a surprise.

3. How local spam protection actually works

Anyone who wants to avoid the cloud needs methods that work without outside knowledge. Three building blocks carry most of the load:

Honeypot fields are input fields that exist in the form but are hidden via CSS. A human doesn't see them and leaves them blank. A bot reads the form from the HTML and dutifully fills in everything it finds. If the invisible field is filled, the sender is, with high confidence, automated.

Time traps measure how long passes between the page loading and the form being submitted. A human needs at least a few seconds to write a contact message. Bots fill out forms in milliseconds, because they don't read the content, just populate the fields. A submission after 400 milliseconds isn't a customer.

Pattern and heuristic checks look at the content itself: the ratio of links to text, Cyrillic characters in the middle of an English sentence, typical promotional phrases, identical messages from changing senders, form fields filled in an order no browser would produce. Each individual signal is weak. Taken together, they add up to a reliable decision – entirely on your own server.

The five alternatives

Antispam Bee: the German classic

Antispam Bee has been the obvious answer to the Akismet question in German-speaking countries for many years: free, GPL, no account required, and working largely locally. The plugin combines heuristics, language checks, and optional lookups, but keeps the checking on your own installation under normal operation. For comment spam, detection is solid and completely sufficient for most blogs.

The limitation is in scope: Antispam Bee takes care of comments and trackbacks. It doesn't cover contact forms, user registrations, or WooCommerce processes like reviews or order notes. If your spam problem isn't just under blog posts but also in your inbox, you need something else on top.

CleanTalk: high detection, but cloud-based

CleanTalk is among the services with the best detection rates in the field, and well beyond comments too: forms, registrations, shop processes. That comes from the same mechanism as Akismet, namely a central database that sees signals from a great many websites simultaneously.

The price for that is the same as with Akismet: checking happens in the cloud. You need a data processing agreement, an entry in your processing register, and a clause in your privacy policy. On top of that come request limits in the plan, which become noticeable on a heavily trafficked site. CleanTalk is the right choice if detection rate matters above everything else.

Cloudflare Turnstile: CAPTCHA without picture puzzles

Turnstile is the lean answer to the CAPTCHA problem: no traffic lights, no bicycles, no distorted letters. As a rule, the visitor just sees a brief checkmark, and the evaluation happens in the background. For usability, that's a clear step forward from picture puzzles.

Two limitations remain. First, you're shifting the check back to a US service, so the privacy question isn't solved, just relocated. Second, Turnstile protects the submission process, not the content: it distinguishes bot from human, but not promotional text from a genuine request. A human typing in paid spam gets through.

reCAPTCHA: widespread and controversial

Google's reCAPTCHA is the best-known method and built into countless forms. It detects bots reliably and costs nothing at normal scale. In exchange, it requires consent, because personal data flows to Google before the check even happens, which forces it into the consent banner and ties it to active opt-in. You can find out how to set that part up cleanly in our post on cookie consent and GDPR.

Then there's accessibility: the audio alternative works but is tedious, and users with screen readers or motor impairments fail disproportionately often. For a contact form meant to bring in requests, every extra hurdle is a lost request.

Wellenbrecher: local checking for the whole website

Our own plugin, so here it is with an open visor. Wellenbrecher is local-first anti-spam for WordPress and protects comments, forms, registrations, and WooCommerce. Checking happens on your own server: no cloud, no data processing agreement needed, no request limit, and commercial use is free.

That closes exactly the gap left open between the previous options. Antispam Bee works locally but only covers comments. CleanTalk covers everything but checks in the cloud. Wellenbrecher combines both: the same scope, but with no data leaving your site. As part of the hafenstudios Fleet, it works together with Leadlotse as a form source, so contact forms are protected alongside it with no extra configuration. If you're already cleaning up the forms side of things, our comparison of Contact Form 7 alternatives is the natural companion article.

The prices: Free costs nothing. Pro is €19 a year for one website, and the Fleet tier covers 10 websites for €69. Pro and Fleet can currently be pre-ordered, the Free version is ready to download today. All tiers are listed on the pricing page. For context: Akismet runs at roughly €120 a year for commercial use, and CleanTalk and comparable services check in the cloud and limit requests. Both figures as of mid-August 2026, with no guarantee the providers will still handle it that way next week.

Comparison table

GDPR: an assessment, not legal advice

Upfront, because it matters: what follows is our assessment as developers, not legal advice. For a binding evaluation of your specific website, please ask someone licensed to give it.

The difference between local and cloud checking isn't a detail from a privacy-law perspective, it's the core issue. With cloud checking, for every comment and every form message you typically transmit: the full text, the sender's name and email address, their IP address, the user agent, and the URL visited. IP address and email address are personal data, and the message text can be too – and almost always is, for contact requests.

Three practical consequences follow from that. First, you need a data processing agreement with the service provider and an entry in your processing register. Second, the transfer has to be named in your privacy policy, with provider, purpose, and recipient country specified. Third, for providers outside the EU, the third-country transfer has to be documented, which means extra review and justification work.

If the check instead runs on your own server, that whole block disappears. There's no recipient, so no contract, no transfer, and no paragraph in the privacy policy that needs explaining. That's the real advantage of local methods, and in practice it outweighs every percentage point of detection rate.

Where local checking reaches its limits

An honest counter-argument belongs here, or this isn't a real comparison. Local checking has no network-wide reputation. If a spam wave hits thousands of websites at the same time, a cloud service spots that pattern after the first few hundred hits and blocks it everywhere from then on. Your installation only sees what arrives at your own site and has to form its judgment on its own.

Local methods make up for this with heuristics, time traps, and honeypots, and that carries surprisingly far in everyday use, because most bots fail the mechanical checks before the content even gets evaluated. But on brand-new patterns, they're slower than a network watching millions of sites at once.

A note on where things stand: Wellenbrecher Pro can currently be pre-ordered, and the Free version is available right away. If you want to see first how much a purely local check catches on your site, the test costs you nothing but the installation.

Frequently asked questions