Stop Storing IP Address in WordPress Comments or Limit the Storage Time

WordPress loves to hoard data. By default, every time someone leaves a comment on your site, the system quietly logs their IP address.

The standard justification is spam prevention. Tools like Akismet use that data to filter the sludge.

But let’s be honest. Holding onto personal data you don’t actually need is just asking for a GDPR headache.

If you moderate your own comments or use a better anti-spam setup, tracking IPs is pointless. It is simply a liability sitting in your database.

Let’s fix that. No over-engineered privacy plugins. Just the exact code you need to stop collecting IPs, scrub the old ones, or set a hard expiration date.

(Standard disclaimer: Back up your database before touching anything. Don’t be the person who breaks their site at 2 AM and has no restore point.)

1. Block Future IPs

You can force WordPress to stop logging IP addresses the second a comment is submitted.

Drop one of these two snippets into your child theme’s functions.php file or your preferred code snippet plugin.

Option A: The Localhost Fake-Out

This forces the system to replace every commenter’s real IP with 127.0.0.1 (localhost). It keeps the database structure happy but strips the personal data.

function bm_remove_ip( $comment_author_ip ) { 
    return '127.0.0.1'; 
} 
add_filter( 'pre_comment_user_ip', 'bm_remove_ip' );

Option B: The Total Wipe

If you want the IP field completely blank, use this instead. It leaves absolutely nothing behind.

function wpb_remove_commentsip( $comment_author_ip ) {
    return '';
}
add_filter( 'pre_comment_user_ip', 'wpb_remove_commentsip' );

To deal with the legacy data already sitting on your server, move to the next step.

2. Nuke the Legacy Data

If your site has been running for a few years, you are already sitting on a massive pile of logged IPs.

The code above won’t touch the old stuff. You have to go into the database and scrub it yourself.

Log into phpMyAdmin through your web host. Find the SQL tab. Run this exact command:

UPDATE wp_comments SET comment_author_IP = '';

Note: If you use a custom database prefix for security (like wp_123_), adjust wp_comments to match your actual table name. Hit go. It’s gone.

3. The Compromise: Set a Self-Destruct Timer

Maybe you still want to log IPs for a few weeks to catch coordinated spam attacks, but you don’t want to hold onto them forever. You can automate the cleanup.

This snippet schedules a daily background job. It runs through your comments and quietly deletes any IP address older than your set limit. Set it and forget it.

// Schedule the daily IP cleanup event
if ( ! wp_next_scheduled( 'daily_scrub_comment_ips' ) ) {
    wp_schedule_event( time(), 'daily', 'daily_scrub_comment_ips' );
}

// The function that deletes the old IPs
add_action( 'daily_scrub_comment_ips', 'scrub_old_comment_ips_function' );

function scrub_old_comment_ips_function() {
    global $wpdb;
    
    // Change the number 60 to your desired amount of days (e.g., 7, 14, 30)
    $days_to_keep = 60; 
    
    $wpdb->query( $wpdb->prepare(
        "UPDATE $wpdb->comments SET comment_author_IP = '' WHERE comment_date < DATE_SUB(NOW(), INTERVAL %d DAY) AND comment_author_IP != ''",
        $days_to_keep
    ) );
}

Look for $days_to_keep = 60; in the code above. Change that number to whatever lets you sleep at night—7, 14, or 30 days. Your call.

One final reality check: If your host takes daily server backups, those deleted IPs will still exist in your backup archives for a few weeks until they cycle out.

You can’t control that, but scrubbing the live database is the step you actually have power over.