Fake reviews are landing on your products. Here is why, and how to stop them for free.

Why your store gets fake reviews

• Reviews are comments. WooCommerce stores reviews in the comments table and accepts them through the same endpoint as blog comments. Anti-spam for comments is anti-spam for reviews.
• Bots skip the page. Purpose-built bots POST directly to the comment endpoint with a product ID. They never load your product page, so honeypot fields and in-page checks never run.
• Clean text passes text filters. Generic five-star praise ("Great product, fast shipping!") contains nothing a content filter can flag, so it lands as an approved or pending review.
• Review spam is SEO spam. Many fake reviews exist to plant a link or a brand name. Others are left by competitors or by services selling "review packages". The same planted names and addresses recur across thousands of unrelated sites, which is what our live threat feed tracks.

Why this now matters legally

Fake reviews stopped being a nuisance and became a compliance issue. In the United States, the FTC's rule on consumer reviews and testimonials has been in force since October 21, 2024. It bans creating, buying or selling fake reviews, and in December 2025 the FTC sent warning letters to ten companies, citing civil penalties of up to $53,088 per violation. In the United Kingdom, the Digital Markets, Competition and Consumers Act added the posting and commissioning of fake reviews to its list of banned practices when its consumer provisions came into force in April 2025, with fines of up to 10 percent of global turnover, and in 2026 the CMA opened investigations into several companies' review practices. The rules target businesses that post or buy fake reviews, but a store whose product pages fill with obviously fake praise invites exactly that suspicion from customers and platforms. Keeping bots off your review form is the simplest way to keep your reviews credible.

Three things to do today

1. Turn on "Reviews can only be left by verified owners" in WooCommerce, Settings, Products. It stops drive-by reviews from people who never bought. It does not stop bots using harvested or fake customer accounts, and it blocks genuine customers who bought elsewhere.
2. Install the free SpamKill plugin. It screens how each review was submitted (timing, interaction, device and network signals) rather than what it says, and rejects bots that POST straight to the endpoint. Nothing changes for real customers. Activate it and it is on.
3. Watch the counter for a week. The dashboard widget shows how many spam attempts never reached your moderation queue. Then decide whether you still need the CAPTCHA you added last year.

What a real customer experiences

Nothing. The review form looks and behaves as before. If a real person is ever flagged, they are offered a quick verification, such as signing in, and their review goes through. No puzzles, no "select all the buses".

Questions store owners ask

Does it work with Customer Reviews for WooCommerce, review reminders, or verified-owner badges?

Yes. Those plugins decide who is invited and how reviews display; SpamKill decides whether the submitter is a bot. They do not overlap.

What about Judge.me, Yotpo or other hosted review widgets?

Those store reviews on their own servers, not as WordPress comments, so they are outside SpamKill's scope. SpamKill covers native WooCommerce reviews.

Does it block real reviews?

Behavior-based screening almost never flags a real shopper, and a flagged person can always verify. The plugin also fails safe: if a form can't be served through SpamKill, no real review is rejected.

Is the free tier really free for a store?

Yes. There is no personal-use clause, no quota and no trial clock on comment and review protection. Contact and lead-gen forms are the paid Pro tier.

Does it need an API key or a Google reCAPTCHA account?

No. Activate and done.