To stop spam listing submissions on a directory website, stack several cheap defences instead of relying on one. Require an account to submit, hold every new listing in a moderation queue, add a hidden honeypot field and per-IP rate limits, turn on CAPTCHA, and filter content by banned words and link counts. Then keep a way to report, block and remove what still gets through.
Generic form-spam advice stops at the CAPTCHA. A directory has a harder problem, because a spam listing is not a stray comment. It is a public page on your domain that search engines can index and that real businesses are judged against. This post walks through the layers that suit a directory, says which ones Listora ships, and marks what needs Pro.
Key points
- Listora submissions need a signed-in account. There is no guest posting, which removes the easiest spam route.
- Honeypot, per-IP rate limits, CAPTCHA, Akismet, banned words and a link cap are all in the free plugin. CAPTCHA is off until you turn it on.
- New listings wait for approval by default. Moderators and the audit log are Pro.
- Plan for a spam wave before it happens. A queue you can clear in bulk is your safety net.
Why directories attract spam
A directory is a public list that search engines trust. A listing carries a name, a link, a phone number and a description, and it sits on a domain with real authority. For a spammer that is a cheap backlink and a free advert.
The common patterns are worth knowing, because each one is stopped by a different layer:
- Link farms. A listing whose description is a wall of links to the same few sites.
- Keyword stuffing. A title like “cheap pills best price buy now” with a business category stuck on it.
- Fake businesses. A plausible name, a stock photo and a phone number that goes to a scammer.
- Duplicates. The same listing submitted again and again, sometimes by a real owner who forgot, sometimes by a bot.
- Bot floods. Hundreds of submissions in an hour from scripts that fill in every field.
- Fake claims and reviews. Spam that does not create listings at all, but attacks the ones you already have.
No single layer catches all of that. The aim is to make each attempt cost more than it earns.
Layer 1: Require an account to submit
The cheapest filter is to make people sign in. In Listora, submitting a listing needs a signed-in account. A visitor who is not signed in sees a sign-in prompt with a link to register, when registration is open on your site. Guest submission was removed in version 1.3.0, so there is no setting to leave open by accident.
Why it works: every listing is tied to an account. You can see who posted what, suspend one account instead of chasing a hundred listings, and a bot has to get past your registration form first. It is not a wall, because bots can register, so it works best with the layers below.
Registration comes from WordPress, so protect it too. Many sites add a CAPTCHA or an email-confirmation plugin to the registration page. That is general advice for any WordPress site, and it is outside Listora.
Layer 2: A moderation queue that holds everything
In Listora > Settings > Submissions, the Moderation setting has two options. Require admin approval is the default, and it holds new listings as Pending until you approve them. Auto-approve publishes at once. The docs say plainly that auto-approve is best paired with CAPTCHA, and for a directory that anyone can sign up to, we would keep approval on.
The queue is the layer that catches what automation misses: the fake business that looks real to a script. Open Listora > All Listings and filter by Pending. Row actions are Approve, Reject, Edit, Feature and Trash. Reject lets you add a note that goes into the email to the poster, so write your standard reasons once.
For volume, select rows and use the Bulk actions dropdown to approve, reject, feature, unfeature or assign a category. Your dashboard also has a Needs attention box that links to each queue.
There are separate queues for reviews (Listora > Moderation > Reviews) and claims (Listora > Moderation > Claims). Review approval is on by default under Settings > Reviews > Require Approval. Claims always wait for a person to decide.
Edits can be moderated too. If a poster edits a listing after approval and your settings re-moderate edits, the listing returns to Pending. That stops the old trick of posting a clean listing and swapping in spam once it is live.
Layer 3: Honeypot and rate limits
These two run on every public form by default and cost you nothing to operate.
Honeypot. Listora adds a hidden input that people never see and leave empty. Bots tend to fill every field they find. If the hidden field has a value, the submission is rejected immediately, before anything is saved.
Per-IP rate limits. A sliding-window counter caps how often one address can submit. It covers listing submissions, reviews, claims and the contact form, and each has its own cap and window. When a request hits the cap, the site answers with a 429 Too Many Requests response and a Retry-After header.
You can tune the caps under the rate-limit settings, and the docs give a practical tip: if you are being targeted, lower the per-hour cap on submissions to a very small number. Two details matter when you tune:
- Trusted proxies. If your site sits behind Cloudflare or another CDN, add the proxy ranges to the trusted proxies setting. Otherwise every visitor looks like the same IP and the limit hits everyone at once.
- IP allowlist. Add your office or monitoring service so they bypass the limits.
Signed-in REST requests and WP-CLI bypass the IP limits, because they are gated by their own login. That avoids locking out real users on shared Wi-Fi.
Rate limiting is general good practice for any form. What is directory-specific is where the caps sit. A power user adds a handful of listings an hour at most, so a tight cap on submissions costs real owners nothing.
Layer 4: CAPTCHA and Turnstile
CAPTCHA is in the free plugin and is off by default. Choose Google reCAPTCHA v3 or Cloudflare Turnstile and paste the site and secret keys from the provider. Both are invisible, so nobody has to click traffic lights.
Turnstile is the one to pick if privacy matters to your audience, because it does not track users. reCAPTCHA v3 scores each visitor in the background.
In the submission settings, CAPTCHA protects the listing submission form and both review forms. The spam docs describe controls for each form (submissions, reviews, claims and contact) and note that claims need a signed-in member and are rate-limited instead. Check the settings screen on your install to see exactly which forms it gates.
Two things to know. First, CAPTCHA is one layer, not the answer. Plenty of spam is entered by real humans paid to do it, and they pass any CAPTCHA. Second, WP-CLI, WP-Cron and logged-in REST requests skip it, which is what you want for imports and apps.
Layer 5: Content filters (Akismet, banned words, link cap)
These look at what was written, not who wrote it.
- Akismet. If the Akismet plugin is active with a valid key, Listora picks it up on its own. It checks review text, owner replies, claim explanations, contact messages and listing submissions. A spam verdict rejects the submission, an unsure verdict sends it to moderation, and if Akismet cannot be reached the check is skipped so real users are not blocked.
- Banned words. A comma-separated list in the settings. Any submission containing a listed word is rejected. Matching ignores case and respects word boundaries.
- URL-density cap. A maximum number of links per text field. The defaults are two links in a review and three in a claim explanation, and developers can change the cap per source with a filter.
For a directory, the link cap is the most useful of the three. Genuine owners put one website in the website field. A description with ten links is almost never genuine.
Start with an empty banned-words list and build it from what you actually see. Reject a spam listing, note the phrase that gave it away, add it. A list copied from the internet will block real businesses, so grow yours from your own queue. That is general advice rather than a Listora feature.
Layer 6: Check for duplicates and fakes at the door
Duplicates are the spam that is not always spam. Listora runs a duplicate check while a poster types a title. It looks at the title and listing type, weighs nearby matches higher when both listings have a location, and shows a side-by-side card for any possible match. The poster can Claim this listing if it is their business, or continue with It’s a different business.
It is in the free plugin, and it needs no setup. It will not stop a determined spammer who changes one word of a title. It does stop the accidental repeat and the lazy script.
Fake listings need a human eye. A few checks that fit a directory, offered as general advice:
- Search the business name and address. If nothing exists outside your site, treat it with suspicion.
- Look at the phone number and email domain. A free webmail address on a business that claims to be a large firm is a flag.
- Check the images. A stock photo or one pulled from another business is easy to spot with a reverse image search.
- Read the description for copy lifted from another site.
Claims work the other way round. A real owner asks for a listing that you added. The claim form asks for proof of ownership and optionally a document, and you review it before approving. That keeps fake owners from taking over real listings.
Layer 7: Charge for listings
Money is the oldest spam filter. A spammer who needs to post two thousand listings will not pay for them. If your directory can charge for placement, a paid plan filters out almost everyone who is not serious.
With Listora Pro, you create pricing plans with a credit cost, and a member buys credits through Stripe, PayPal, WooCommerce, MemberPress or Paid Memberships Pro. Free listings can sit beside paid ones, and a free plan can stay under moderation.
There is one thing to understand before you rely on this. In Listora Pro, a listing paid for with a plan goes live as soon as the plan is paid, even when approval is required, because paying is treated as the trust signal. If you would rather review paid listings too, the docs say to return false from the wb_listora_pro_plan_auto_publish filter. A stolen card can still buy a plan, so decide whether you trust that signal on your site.
Separately, the free plugin lets you cap how many listings each role may submit, under Listora > Settings > Credits > Limits. Pick a limit period (lifetime, calendar month or rolling 30 days) and set Block submission as the beyond-limit behaviour, and a member who has used their quota cannot flood you.
Layer 8: Reports, blocking and suspension
Some spam will get through. The next layer is making it easy to remove.
Reports. Any signed-in visitor can click Report on a listing and pick a reason such as spam, inappropriate, wrong category or duplicate. Reports land in Listora > Reports for you to review. The listing owner is not notified, so a spammer does not learn who reported them. Reviews have a report workflow too.
Member blocking. This is a free feature, but be clear about what it is. A member can block another member, which hides that person’s reviews from them and closes the contact route between them. It is a member’s private remedy against a pest, and it does not remove anything from the site. It does not replace moderation, and a block does not notify anyone. Use it as one tool for the member-to-member problem, and use reports for rule-breaking content.
Suspending accounts. When one account is behind many listings, you act on the account, not on each listing. Because every submission needs an account, you have something to suspend. With Pro, the audit log records member suspensions and reinstatements.
Layer 9: Moderators and the audit log (Pro)
As a directory grows, you stop being the only person reading the queue. Pro adds a Listora Moderator role. A moderator can approve and reject listings, moderate reviews and manage claims, and cannot change settings, delete listings or manage listing types. New submissions are handed to active moderators in turn, round-robin, and you can pause a moderator while they are away.
The Audit Log, at Listora > Tools > Audit Log, is a searchable record of who created, edited, approved or deleted what, with the time and IP address. It also records settings changes, member suspensions and refused payment-webhook requests. Spam rejections are noted with their reason, and the docs list the reasons as honeypot, rate limit, CAPTCHA, Akismet, banned word and URL density.
Two uses matter. When a moderator approves something they should not have, the log shows it and you can talk about it with evidence. And when a spammer says they never posted, you can show the record. Free sites do all of this through the administrator role, without the audit trail.
What to do when a spam wave hits
A wave is a burst: dozens or hundreds of submissions in a short time. Do not panic and do not delete things one at a time. Work through this order.
- Slow the flood. Lower the submission rate limit to a very small number for a day. Turn on CAPTCHA if it was off.
- Check your settings. Make sure moderation is on Require admin approval. If you had switched to auto-approve, switch back now.
- Look at the pattern. Open the pending listings. Are the titles similar? Same links? Same few accounts? That tells you which filter to add.
- Add the phrase or link pattern. Put the repeated words in banned words. Lower the link cap if the spam is link-heavy.
- Clear in bulk. Select the spam rows on the Pending list and use the Bulk actions dropdown to reject or trash them. Spot-check a few first.
- Act on the accounts. Suspend the accounts that posted them, so the same people cannot start again.
- Review what already went live. If anything slipped through before you tightened up, search for the same phrases in published listings and trash them.
- Loosen later. Once things are quiet, ease the rate limit back to a level that suits real owners.
With Pro, the audit log shows what was rejected and why, which tells you whether your filters are doing their job. Without Pro, Recent Rejections in the security settings lists the last 50 rejected attempts, according to the docs.
Afterwards, write down what worked. Next time you will recognise the pattern faster.
A sensible default setup
If you want to set this up once and move on, here is a starting point for a public directory:
| Layer | Setting |
|---|---|
| Account | Required (always on) |
| Moderation | Require admin approval |
| Honeypot and rate limits | Leave on, tighten if targeted |
| CAPTCHA | On, Turnstile or reCAPTCHA v3 |
| Akismet | Install and activate |
| Link cap | Keep the defaults |
| Banned words | Start empty, grow from the queue |
Check the queue daily for the first two weeks, then tune. A small directory with approval on and CAPTCHA enabled usually sees very little spam reach the public.
What Listora does not do
It is better to know the limits now. Listora does not check a business against an outside register, so spotting a fake business is a judgement you make. CAPTCHA and rate limits cannot stop people who are paid to post by hand. There is no automatic blocklist shared between sites. And no filter replaces a person looking at the queue. The layers make that person’s job small, not zero.
For the full setting-by-setting detail, the spam protection docs, the rate limiting docs and the moderation queue docs cover each screen. The Free vs Pro page lists what each tier includes, and you can try the moderation screens yourself in the live demo before you install anything.