How can I protect my WordPress website from spam comments and unwanted submissions?

I’m looking for some practical advice on protecting a WordPress website from spam comments, fake form submissions, and other unwanted messages. As a website grows, it seems that automated bots and spam submissions can become a real problem, especially when contact forms and comment sections are enabled.
I’d like to know what methods experienced WordPress users recommend for dealing with this issue without making the website difficult for genuine visitors to use. Are security plugins enough, or should I also use tools such as CAPTCHA, comment moderation, spam filters, or other WordPress security settings?
I’m currently working on My Website, my website is covering technology, digital tools, and useful online resources, so keeping the site clean and providing a good user experience is important to me. I’m particularly interested in solutions that are lightweight and don’t negatively affect website speed.
What combination of WordPress settings, plugins, and security practices has worked best for you when dealing with spam comments and unwanted submissions?