You’re staring at another unfamiliar link notification in your moderation queue, and WordPress trackback spam makes you wonder whether your site has been hacked.
You need to know whether marking it as spam is enough, how to stop new notifications, and what to do with posts that already allow them.
This guide follows that queue from the first cleanup decision to the safer settings change, while keeping ordinary backlinks and unrelated WordPress integrations in view. By the end, you’ll have a focused way to close the problem without making a broader change than your site needs.
TL;DR: Marking an item as spam cleans up that item, but it does not stop new requests. If you do not intentionally use pingbacks or trackbacks, turn off link notifications for new posts, close them on older posts that still allow them, and keep moderation enabled while you clean up the current queue. You may also use a security plugin to help filter and block future abuse.
What trackback spam means
When the unfamiliar item first arrives, trackback spam is an unwanted link notification, not proof that your site has been hacked. A trackback or pingback is a notification sent when one site links to another site. WordPress can show the notification as a comment or as an item awaiting moderation, usually to place an unfamiliar link in your comments or consume your time in the moderation queue.
If unfamiliar links appear inside your published content rather than in the moderation queue, investigate possible spam link injection as a separate issue.
Trackbacks and pingbacks are related, but they are not identical. A trackback is manually initiated and may include a short excerpt from the linking page, whereas a pingback is automated and normally carries no excerpt. Both are link-notification mechanisms. Neither one is the backlink itself, and disabling them does not remove ordinary links to your site.
That distinction matters when the spam starts appearing in the queue. You are deciding whether your site needs link notifications, not whether other sites are allowed to link to you.
Decide whether you need link notifications
Most ordinary business sites, blogs, portfolios, and small stores do not need to receive pingbacks or trackbacks. With the unfamiliar notification still in view, turn the feature off when it has no deliberate role in your publishing workflow.
This is the mistake I see most often: a site that genuinely relies on inter-blog notifications has a different decision to make.
📝 Note: If one editorial workflow still depends on these notifications, test the change on a staging copy and document the exception before closing the feature.
Keep the feature only when you have a clear reason to use it, such as a publishing or editorial workflow that relies on inter-blog notifications. In that case, keep moderation and filtering in place. A WordPress anti-spam plugin can reduce obvious spam, but it can also hide a legitimate notification, so it should not replace review when the feature matters to you.
Disable trackbacks for new posts
Use the supported WordPress setting first. Once you’ve decided the notification feature is unnecessary, change the default for new content without deleting files or changing unrelated remote-publishing features.
- Open the Discussion settings. In the WordPress administrator area, go to Settings > Discussion.
- Turn off link notifications. Clear “Allow link notifications from other blogs (pingbacks and trackbacks).”
- Save the new default. Save the settings, then check a newly created post before publishing if you want to confirm that its pingback or trackback option is closed.
📝 Note: This checkbox changes the default used for new content; it is not a bulk edit of posts that already have their own ping status.
The important limitation is the word “default.” On a clean WordPress 6.9.4 site tested with PHP 8.2 and MySQL 8.0, the site snapshot showed default_ping_status: open. Three newly seeded published posts also returned ping_status: open and comment_status: open through the WordPress REST API. That test confirmed the starting state and the post fields, but it did not inject a trackback or run the moderation flow.
In practice, this means you should not assume that changing the global setting has cleaned up posts that already exist. It prevents the setting from being carried into future posts, while older posts may retain their own status.
Close trackbacks on existing posts
Check older posts when the queue continues after the global setting is changed. The reader who has just changed the default should open a post in the editor, expand its Discussion or related post settings, and turn off the pingback and trackback option if it is still enabled.
The exact control can vary with the current editor interface, so confirm that you are changing link notifications rather than ordinary comments. For a small site, the safest approach is to check the posts that receive spam. It lets you leave a deliberate exception open if one post or content type still uses link notifications.
For a large site, ask a WordPress administrator or developer to make a scoped bulk change to the ping_status value for the intended post types. Before making a bulk change, create a full backup using a reliable WordPress backup plugin, verify that it can be restored, confirm the actual database table prefix, and exclude custom post types or legacy content that has a documented need for trackbacks. A bulk database update should not be run from a copied example without checking those details.
📝 Note: A bulk database change is easy to widen accidentally, so take a tested backup and verify the table prefix before running it.
The goal is to close the notification feature on the content that needs closing. Do not change comment status at the same time unless you also want to stop ordinary comments.
Clean up the spam already received
Disabling trackbacks prevents or reduces future notifications, but it does not remove items already in the comments or moderation queue. Now return to the unfamiliar item that started the problem and handle the existing queue separately.
- Mark clear spam as spam. This moves the current unwanted item into the normal spam workflow.
- Delete items that are clearly unwanted. Do not approve unfamiliar links just because they mention your site.
- Review the remaining queue. A legitimate notification can be mistaken for spam if the site still uses the feature.
- Check the source and content before visiting links. An unfamiliar URL is a reason to inspect the item carefully, not a reason to click it from the administrator screen.
Comment moderation and spam filtering are separate from the global link-notification default.. A spam filter, honeypot, CAPTCHA, firewall, or other traffic control can help with unwanted submissions, but those tools do not answer the basic question of whether your site should accept pingbacks and trackbacks at all.
Do not confuse trackbacks with XML-RPC
XML-RPC is related to pingbacks, but it is a broader WordPress interface. If the queue remains active or you are considering a server rule, check what else the site uses before blocking the endpoint.
Blocking it may affect more than link notifications, including remote publishing, mobile apps, Jetpack, or another integration used by the site. Treat disabling XML-RPC as an optional hardening decision, not as the default fix for WordPress trackback spam., not as the default fix for WordPress trackback spam. First check whether any active integration depends on XML-RPC.
📝 Note: Before blocking XML-RPC, list the integrations that publish, sync, or monitor the site and test each one after the change.
If the site does not need it and the operator understands the wider scope, a scoped server or application rule may be appropriate. Test publishing, connected services, and monitoring after the change.
Turning off “Allow link notifications from other blogs” is the narrower fix. It addresses the WordPress feature that the reader is trying to disable without assuming that every XML-RPC request is unwanted.
Is wp-trackback.php safe to delete?
With XML-RPC kept separate, do not delete wp-trackback.php as the normal solution. The endpoint is associated with trackbacks, but deleting a core file is a brittle way to change a feature setting. It can create maintenance problems and leaves the installation different from the core files that WordPress expects to manage.
📝 Note: Core-file changes can be overwritten by updates and can make later troubleshooting harder, so keep the supported setting as your first control.
The safer sequence is to disable link notifications in Settings > Discussion and close them on existing posts. If a site has a specific reason to reject requests to the endpoint, the owner can consider an explicit, scoped server or application rule after checking integrations and documenting the change. That is different from deleting the file and hoping the spam stops.
This also answers a common fear: the endpoint and the notification setting are not the same thing as ordinary backlinks. Removing or blocking the endpoint does not remove links that other sites have already placed on the web.
When trackback spam points to a wider problem
With the narrow fixes in place, broader investigation is warranted when the spam appears alongside other signs of compromise.
Look for unauthorized administrator accounts, changed content, unexpected redirects, malware warnings, unknown files, or other activity that you cannot explain. In that situation, preserve evidence, check recent changes, and scan the site instead of treating the Discussion setting as a complete security investigation.
A safe resolution checklist
For the owner still looking at the moderation queue, the complete fix is short:
- Decide whether the site has a real need for pingbacks or trackbacks.
- Turn off “Allow link notifications from other blogs (pingbacks and trackbacks)” in Settings > Discussion when it does not.
- Review older posts and mark existing notifications as spam, then review anything that might be legitimate.
- Check XML-RPC dependencies before blocking the endpoint, and leave wp-trackback.php in place unless a qualified operator has a documented, tested reason to use a scoped rule instead.
- Investigate the site more broadly if spam is accompanied by signs of compromise.
FAQs
Is marking WordPress trackback spam as spam enough?
No. It handles the item that has already arrived, but it does not change the setting that permits future link notifications. Disable the feature when the site does not need it, and check older posts separately.
How do you disable trackbacks in WordPress?
Go to Settings > Discussion, turn off “Allow link notifications from other blogs (pingbacks and trackbacks),” and save. Then check existing posts because the global setting is a default for new content.
What is a pingback on WordPress?
A pingback is an automated notification that one site has linked to another. A trackback is a related notification that is manually initiated and may include an excerpt. Neither is the backlink itself.
Does disabling trackbacks remove backlinks?
No. Disabling pingbacks and trackbacks stops the notification mechanism. It does not remove ordinary links from other sites to your content.
Should you delete wp-trackback.php or block XML-RPC?
Neither should be the first fix. Keep the core file and use the Discussion setting. Check integrations before considering an XML-RPC block because XML-RPC is broader and may support remote publishing or connected services.
Conclusion
The owner who started with an unfamiliar notification now has a narrower path forward: treat WordPress trackback spam as a configuration and moderation problem first, turn off link notifications when they are not needed, close the setting on older posts, and clean the current queue.
Before taking a broader action, inspect the posts that are still receiving notifications and confirm any XML-RPC dependencies. If the same queue is accompanied by signs of compromise or malicious traffic beyond link notifications, preserve evidence and investigate the site more broadly.
Once the immediate issue is resolved, review your broader WordPress security practices to reduce other risks.
