Why Comment Spam Targets the Website Field

The Website field in the WordPress comment form looks harmless.

It simply allows a visitor to provide a URL alongside their name, email address and comment.

But that small field is one of the reasons WordPress comment sections attract large amounts of automated spam.

The incentive is straightforward:

submit comment
+
enter website URL
+
comment gets published
+
author name becomes a link

For a spammer trying to place links across thousands of websites, that is an attractive target.

Modern WordPress already adds protective link attributes to comment-author URLs, and search engines are far more sophisticated about user-generated links than they were many years ago.

That does not prevent bots from trying.

This guide explains why comment spam frequently targets the Website field, how WordPress handles comment-author links today, why removing the field can reduce one incentive for spam, what removing it does and does not solve, and how to build a more complete WordPress comment-spam strategy.

What is the Website field in WordPress comments?

When comments are enabled, WordPress can display fields such as:

Name
Email
Website
Comment

The Website field allows the commenter to submit a URL associated with their identity.

A typical form might contain:

Name: John
Email: john@example.com
Website: https://example.com/
Comment: Thanks for the article.

If the comment is approved and the active theme displays the author’s URL, the visible author name can become a clickable link.

The Website field is not the same as a link inside the comment

There are two different ways a commenter might try to place a URL.

Method 1: put a link in the comment text

Great post!

Visit:
https://example.com/

Method 2: use the Website field

Name:
John

Website:
https://example.com/

Comment:
Great post!

The second method can be less visually obvious because the URL may appear only through the author’s linked name.

Why is the Website field attractive to spammers?

Comment spam is often motivated by promotion.

The official WordPress documentation on comment spam explains that many spam comments are posted specifically to promote another website, product or service and that much of this activity is automated.

The Website field gives spammers a standardized place to submit a target URL.

The basic spammer objective

Conceptually:

find WordPress site
↓
find open comment form
↓
submit plausible text
↓
insert promotional website URL
↓
hope comment is approved
↓
obtain visible link

Automation makes this scalable

A human could manually submit ten promotional comments.

A bot can attempt the same pattern against:

100
1,000
10,000
or more websites

with very little marginal cost.

Spammers do not need every submission to succeed

If only a small percentage of attempted comments are approved, automation can still make the campaign worthwhile from the spammer’s perspective.

For example:

10,000 attempted comments
↓
2% approved
↓
200 published placements

The exact economics vary, but the important point is that automation allows attackers to tolerate extremely low success rates.

Generic compliments are often designed to pass moderation

Typical low-quality comments may look like:

Great article!

Very useful information.

Thanks for sharing.

Interesting post.

I learned a lot from this.

The text itself may be almost meaningless.

Its purpose can simply be to make the submission look legitimate enough that a moderator approves the comment and therefore publishes the associated Website URL.

The spammer often cares more about the author link than the comment

From the spammer’s perspective:

comment text
→ delivery mechanism

Website field
→ promotional target

This helps explain why some spam comments appear superficially polite while contributing nothing to the discussion.

How WordPress creates the Website field

WordPress generates its standard comment form through:

comment_form()

The official comment_form() documentation confirms that the default form fields can include:

• author;
• email;
• url;
• cookies.

The field relevant to this guide is:

url

The Website field can be filtered

WordPress exposes:

comment_form_default_fields

The official comment_form_default_fields documentation allows developers to modify the default comment-form fields.

Remove the Website field from the WordPress comment form

A standard implementation is:

add_filter(
    'comment_form_default_fields',
    function ( $fields ) {
        unset( $fields['url'] );

        return $fields;
    }
);

This removes the default Website field from the comment form.

Use a named function if you prefer explicit reusable code

function mysite_remove_comment_website_field( $fields ) {
    unset( $fields['url'] );

    return $fields;
}

add_filter(
    'comment_form_default_fields',
    'mysite_remove_comment_website_field'
);

What changes after removing the field?

The standard comment form becomes closer to:

Name
Email
Comment

instead of:

Name
Email
Website
Comment

This removes one obvious incentive for link-oriented spam

A bot designed primarily to obtain an author-profile link loses the standard URL field.

That can make your comment form less attractive to certain kinds of automated campaigns.

Removing the Website field does not stop all comment spam

This point is critical.

A spammer can still submit:

Visit https://spam.example/

inside the actual comment body.

Other bots may submit spam for:

• brand exposure;
• phishing;
• malware distribution;
• scams;
• keyword promotion;
• testing vulnerable forms;
• automated account or submission discovery.

Website-field removal is one layer, not an anti-spam system

The correct model is:

remove Website field
→ removes one spam incentive

moderation
→ catches suspicious submissions

anti-spam filtering
→ identifies automated abuse

comment policy
→ determines whether comments should exist at all

Why does a comment-author URL matter to spammers?

Traditional link-spam campaigns were often built around the assumption that placing links on other websites could improve:

• search visibility;
• link metrics;
• referral traffic;
• domain discovery;
• brand exposure.

Search engines have spent many years reducing the usefulness of these tactics.

Google explicitly treats manipulative comment links as spam

Google’s Search spam policies identify manipulative links placed through forum comments and similar user-generated environments as examples of link spam.

Google also identifies spam comments on blogs as a form of user-generated spam.

This means approving spam links is not an SEO strategy

A legitimate WordPress site should not approve irrelevant comments merely because the comments increase visible activity.

Low-quality user-generated content can instead:

• reduce discussion quality;
• create unsafe outbound links;
• increase moderation workload;
• make pages look abandoned or poorly maintained;
• expose visitors to deceptive websites.

Modern WordPress qualifies comment-author links

Current WordPress Core handles external comment-author links more carefully than very old versions of WordPress did.

The function:

get_comment_author_link()

generates the author link when a comment contains a Website URL.

The official get_comment_author_link() source shows that WordPress currently adds:

ugc

to comment-author links.

For external URLs, Core also adds:

external
nofollow

A typical external author link can therefore resemble

<a
    href="https://example.com/"
    class="url"
    rel="ugc external nofollow"
>
    John
</a>

What does rel=”ugc” mean?

ugc indicates that the link appears in user-generated content.

That is appropriate for environments such as:

• comments;
• forum posts;
• community submissions.

What does rel=”nofollow” mean?

nofollow tells search engines that the site is not providing the normal form of editorial endorsement associated with an ordinary link.

This is particularly appropriate when the destination was supplied by an untrusted commenter rather than intentionally selected by the publisher.

Modern WordPress therefore already reduces the SEO value of comment-author links

A simplistic old model might assume:

comment link
→ normal editorial backlink
→ SEO benefit

That is not an accurate description of how modern WordPress handles external author URLs.

So why do bots still target the Website field?

There are several reasons.

1. Automation is cheap

A bot does not need to carefully evaluate every target before submitting.

2. Some websites use custom comment markup

Not every theme or plugin necessarily renders author URLs using WordPress’s default behavior.

3. Some spam systems use outdated assumptions

Automated spam software does not need to be technically sophisticated to continue running.

4. Referral traffic may still have value

A visible link can potentially generate human clicks even when it provides little or no useful search-ranking benefit.

5. Spammers operate at scale

Even weak opportunities can be attractive when millions of automated attempts cost almost nothing.

Removing nofollow is generally a bad idea for untrusted comment links

Developers sometimes remove nofollow from comment-author URLs because they want to reward community members.

That changes the incentive structure.

If arbitrary visitors can obtain ordinary followed links simply by submitting a comment, the comment form becomes more attractive to link spammers.

If you selectively reward contributors, use an intentional system

For example, trusted members could receive links through:

• author profiles;
• approved member directories;
• editorially reviewed contributor pages;
• manually curated resources.

That is more controlled than automatically treating every commenter’s Website field as an editorial recommendation.

The Website field can also encourage keyword-rich names

A spam comment might use:

Name:
Best Cheap Hosting

instead of:

Name:
John Smith

combined with:

Website:
https://example.com/hosting

The objective is to turn the visible author name into promotional anchor text.

This is easy to recognize during moderation

Suspicious commenter names may include:

• product names;
• city + service combinations;
• commercial search phrases;
• casino terminology;
• pharmaceutical terms;
• financial promotions;
• adult or deceptive marketing keywords.

A legitimate commenter can still have a business name

Do not automatically classify every commercial-looking name as spam.

Evaluate:

• comment relevance;
• comment quality;
• URL destination;
• submission pattern;
• other comments from the same source.

The combination is more informative than one field alone

For example:

Name:
Plumber London

Website:
commercial plumbing URL

Comment:
Nice post thanks

is much more suspicious than:

Name:
Sarah

Website:
personal portfolio

Comment:
detailed response discussing
specific points from the article

Comment spam often uses vague language intentionally

A bot wants one message to work on:

• a WordPress tutorial;
• a recipe;
• a travel article;
• a business page;
• a photography post.

So it generates phrases with almost no topic specificity.

Examples include:

Excellent information.

I really enjoyed this.

Very informative article.

Keep up the good work.

Specificity is useful during moderation

A genuine comment is more likely to reference:

• a point made in the article;
• a question about the content;
• a personal experience related to the topic;
• a specific technical detail.

This is not a perfect rule, but it can help separate discussion from link-placement attempts.

Removing the Website field can reduce moderation ambiguity

If your community has no real reason to submit personal websites, removing the field simplifies moderation.

You no longer need to ask:

Is this person contributing genuinely
or mainly trying to obtain a link?

because the standard comment form no longer offers that link-placement mechanism.

When does the Website field provide real value?

There are legitimate cases where it can be useful.

For example:

• developer communities;
• design communities;
• blogging communities;
• professional networking discussions;
• creator communities.

A commenter may reasonably want other participants to discover their:

• portfolio;
• personal blog;
• project;
• professional site.

Do not remove the field automatically from every site

The decision should reflect the community.

Ask:

Does allowing commenters
to provide a website meaningfully
improve this discussion?

If the answer is no, removing the field is easier to justify.

For many business websites, the field adds little value

Consider a company blog where comments are mainly used for:

• questions;
• feedback;
• clarifications.

The commenter’s personal website may be irrelevant to all three.

In that situation:

Website field benefit
→ low

spam incentive
→ potentially high

The field is optional by default

WordPress does not require visitors to provide a Website URL in order to submit a normal comment.

Removing it therefore does not prevent visitors from supplying the core information needed for a discussion.

Name and email serve different purposes

The standard fields have different functions.

Name
→ identifies commenter

Email
→ moderation / identity-related workflow

Website
→ optional external URL

This makes the Website field particularly easy to remove when it does not serve a clear community purpose.

Remove the field through WordPress, not CSS

You could theoretically write:

.comment-form-url {
    display: none;
}

but that only hides the field visually.

CSS does not remove the form field from the server-generated form structure

Using:

comment_form_default_fields

is clearer because the field itself is removed from the standard generated form.

Use the native filter

add_filter(
    'comment_form_default_fields',
    function ( $fields ) {
        unset( $fields['url'] );

        return $fields;
    }
);

Test with your active theme

Most themes that rely on:

comment_form()

will respect the filter automatically.

However, some themes or plugins can implement custom forms.

A custom comment form may ignore the default fields

If the Website field remains visible after applying the filter, inspect whether the theme or plugin:

• builds its own HTML form;
• passes custom fields to comment_form();
• adds another URL input through a hook;
• uses a third-party comments system.

Classic and block themes can expose comments differently

The underlying comment system remains WordPress, but presentation differs between theme architectures.

For a detailed comparison, see WordPress Comments in Classic vs. Block Themes.

Test the field removal in both frontend contexts

Verify:

• logged-out comments;
• logged-in comments;
• classic comment templates;
• block-theme comment forms;
• custom plugin forms.

Logged-in users may see a different form

When a user is already authenticated, WordPress does not necessarily display the same identity fields as it does for anonymous commenters.

Do not test only while logged in as Administrator.

Use a private browsing session

After removing the field:

1. Open an article while logged out.
2. Scroll to the comment form.
3. Confirm the Website field is absent.
4. Submit a legitimate test comment.
5. Verify moderation still works.

Removing the field does not clean existing author URLs

If your database already contains comments with:

comment_author_url

removing the Website form field affects future form submissions.

It does not automatically erase URLs stored on historical comments.

Old comment-author links can remain visible

Suppose you remove the field today.

A comment from last year may still contain:

comment_author_url =
https://old-example.com/

The theme may continue displaying that author’s link.

Form removal and historical cleanup are separate tasks

remove Website field
→ prevent normal future URL entry

clean old author URLs
→ modify historical comment data

Do not erase historical URLs without a reason

Some existing links may belong to genuine community members.

Audit before applying a bulk deletion.

Old spam comments deserve separate treatment

If historical comments are clearly spam, mark or delete them through the normal WordPress comment-management workflow.

The official WordPress Comments documentation distinguishes:

• Pending;
• Approved;
• Spam;
• Trash.

Mark spam as spam rather than merely removing its URL

A comment containing meaningless promotional content does not become useful simply because its Website field is emptied.

If it is spam, treat the comment as spam.

WordPress also provides a spam status programmatically

The Core function:

wp_spam_comment()

can mark an existing comment as spam.

The official wp_spam_comment() documentation covers this programmatic workflow.

Moderation remains one of the strongest controls

Under:

Settings
→ Discussion

WordPress can require:

Comment must be manually approved

before publication.

The official Comment Moderation documentation describes how comments can be held for administrator review.

Manual moderation changes the spammer’s success condition

Without moderation:

submit
→ potentially published

With moderation:

submit
→ queue
→ human review
→ approval required

Moderation does not stop submission volume

It prevents unwanted comments from automatically becoming public, but large spam volumes can still create:

• database records;
• moderation queues;
• notification emails;
• administrative workload.

Use moderation together with anti-spam filtering

A practical layered approach might include:

remove unnecessary Website field
+
anti-spam filtering
+
moderation rules
+
comment policy

WordPress can hold comments containing multiple links

Discussion Settings include a threshold for the number of links a comment may contain before being held for moderation.

The WordPress documentation specifically notes that many spam comments contain multiple links and that this option can help catch them.

This does not directly control the Website field

The URL in the author’s Website field is conceptually separate from links typed inside the comment text.

Do not assume:

hold comments with 2 links

means:

Website field disabled

Use moderation keywords and disallowed terms

WordPress lets administrators configure terms that cause comments to be:

• held for moderation;
• blocked or classified according to site configuration.

Useful patterns might include recurring:

• spam domains;
• email addresses;
• commercial keywords;
• IP addresses;
• common campaign phrases.

Do not make blocklists excessively broad

A generic term may appear in legitimate discussions.

For example, blocking:

web

would be inappropriate on a website discussing WordPress development.

Review spam patterns before creating rules

Good filtering is specific enough to catch repeated abuse without generating large numbers of false positives.

Requiring registration changes the attack surface

WordPress can require users to be registered and logged in before commenting.

This creates additional friction for automated anonymous spam.

But it also creates friction for legitimate visitors.

Do not require accounts solely because spam exists

For many blogs, forcing every commenter to create an account may reduce legitimate participation more than it improves the user experience.

Use the control when it matches the site’s community model.

Closing comments completely is the strongest option

If a website does not use comments at all, there is no need to spend resources defending an unused public form.

In that case, consider removing the feature entirely.

See How to Completely Disable Comments in WordPress.

TheOneWP Disable Comments

If comments do not belong to the site’s workflow, TheOneWP Disable Comments provides a dedicated way to disable the WordPress comment system.

This can be cleaner than maintaining anti-spam defenses for a discussion feature the website never intended to use.

Do not disable all comments just because the Website field attracts spam

If the community benefits from legitimate discussion, closing comments entirely may be unnecessarily aggressive.

Instead, consider:

keep comments
+
remove Website field
+
moderate submissions
+
use anti-spam controls

Comment policy should reflect actual site goals

There are several reasonable configurations.

Community blog

Comments
→ enabled

Website field
→ potentially useful

Moderation
→ enabled

Anti-spam
→ enabled

Business blog with occasional questions

Comments
→ enabled

Website field
→ removed

Moderation
→ enabled

Anti-spam
→ enabled

Corporate brochure site

Comments
→ unnecessary

Comment system
→ disabled

Removing the Website field can improve privacy minimization too

If a piece of information has no practical purpose for your site, not collecting it can simplify data handling.

The Website field is usually not essential for the core act of discussing an article.

Do not overstate the privacy benefit

Removing one field does not mean the entire comment system becomes privacy-neutral.

Comments can still involve:

• names;
• email addresses;
• cookies;
• IP-related processing depending on configuration;
• comment text;
• timestamps.

Removing the field can reduce outbound-link maintenance

Author URLs can become problematic over time.

A genuine domain can later:

• expire;
• change ownership;
• redirect somewhere unrelated;
• become malicious;
• become an advertising domain.

Historical comments can therefore create link rot

A comment from ten years ago might contain an author Website URL that no longer belongs to the original commenter.

This is another reason to consider whether public author URLs provide enough value to justify maintaining them.

Comment links are user-generated outbound links

They should not receive the same level of trust as links deliberately placed by your editorial team.

Modern WordPress’s use of:

ugc
nofollow

for external comment-author links reflects that distinction.

Do not manually remove modern link attributes without understanding the consequence

WordPress exposes the:

comment_author_link_rel

filter for modifying the rel values associated with comment-author links.

That flexibility is intended for controlled customization.

Removing protective attributes globally can increase the attractiveness of your comment section to link-oriented spam.

Spam can target old posts as well as new ones

Bots do not necessarily care when an article was published.

An old post can remain attractive if:

• comments are still open;
• the form is publicly accessible;
• the page is indexed;
• the page has existing authority or traffic.

This explains spam on articles nobody has touched for years

The bot may have discovered the URL through:

• search engines;
• sitemaps;
• old link lists;
• automated crawling;
• previous spam databases.

Automatically closing old discussions can reduce exposure

WordPress can automatically close comments on articles after a defined number of days.

This is useful for websites where discussion is relevant only near publication time.

Do not use automatic closing when evergreen discussion matters

A tutorial or support article might continue receiving useful questions years after publication.

Again, comment policy should serve the actual content model.

Changing global settings may not close old posts

Disabling comments under Settings → Discussion primarily changes the default for future content.

Older posts may retain their stored comment status.

See WordPress Per-Post vs. Site-Wide Comment Settings.

Historical comments do not disappear when commenting is disabled

If you eventually disable comments, existing approved discussions can remain stored and visible.

See What Happens to Old Comments When You Disable Them.

A practical anti-spam configuration

For a WordPress site that wants to keep legitimate comments but has no need for commenter websites, a practical configuration can look like:

Comments
→ enabled

Website field
→ removed

Manual approval
→ enabled where appropriate

Link moderation
→ configured

Anti-spam filtering
→ enabled

Old unused comment forms
→ closed

Example site-level implementation

/**
 * Remove the Website field from
 * the standard WordPress comment form.
 */
add_filter(
    'comment_form_default_fields',
    function ( $fields ) {
        unset( $fields['url'] );

        return $fields;
    }
);

Where should this code live?

If removing commenter websites is a site policy rather than a visual-theme choice, appropriate locations include:

• a site-specific plugin;
• a must-use plugin;
• a maintained snippets system.

A theme change should not necessarily restore the field

If the site’s permanent policy is:

we do not collect commenter websites

then keeping the configuration outside a disposable theme is usually more robust.

Test after theme changes

The active theme determines how comment forms are rendered.

After changing themes, verify that:

• the Website field remains absent;
• comment submission still works;
• required fields remain accessible;
• error messages remain usable;
• mobile layout remains correct.

Test after comment-plugin changes

A third-party comment plugin may replace the native form entirely.

If that happens, the:

comment_form_default_fields

filter may no longer control the visible fields.

Inspect the actual rendered form

Do not assume a snippet works because it is syntactically correct.

Verify the frontend output.

Comment spam audit checklist

• Determine whether your site actually needs comments.
• Determine whether commenters need a Website field.
• Inspect the logged-out comment form.
• Check whether the Website field is generated by native comment_form().
• Remove the url field with comment_form_default_fields where appropriate.
• Do not rely only on CSS to hide it.
• Test native comments after field removal.
• Test classic theme templates.
• Test block-theme comment forms.
• Test custom comment plugins.
• Remember that removing the field does not stop links inside comment text.
• Enable appropriate moderation.
• Review the number-of-links moderation threshold.
• Review moderation keywords.
• Review disallowed terms carefully.
• Avoid excessively broad blocklists.
• Use anti-spam filtering where comment volume requires it.
• Review generic low-value comments carefully.
• Review keyword-rich author names.
• Review suspicious Website destinations.
• Do not approve comments solely because they sound polite.
• Mark actual spam as spam.
• Clean historical spam separately.
• Do not assume old author URLs disappear after removing the field.
• Audit historical author URLs if necessary.
• Keep WordPress’s protective author-link attributes unless you have a specific reason to change them.
• Remember that external author links are currently marked with ugc and nofollow by Core.
• Do not treat comment links as editorial endorsements.
• Close comments on content that does not need discussion.
• Review old posts separately from future comment defaults.
• Consider disabling comments completely when the feature is unused.
• Test while logged out.
• Test on mobile.
• Re-test after theme or comment-plugin changes.

Related guides

• How to Completely Disable Comments in WordPress
• WordPress Per-Post vs. Site-Wide Comment Settings
• What Happens to Old Comments When You Disable Them
• WordPress Comments in Classic vs. Block Themes
• Pingbacks, Trackbacks & Internal Links
• WordPress Staging Site Best Practices

Final recommendation

The WordPress Website field attracts spam because it offers a standardized way for commenters to associate an external URL with a published comment.

The basic incentive is:

comment
+
author URL
+
approval
=
public external link

Modern WordPress already reduces the usefulness of that tactic by qualifying external comment-author links with attributes such as:

rel="ugc external nofollow"

but automated spam continues because submission is inexpensive, scalable and occasionally successful.

If commenter websites provide no real value to your community, removing the Website field is a sensible reduction in attack surface and moderation noise.

Use the native:

comment_form_default_fields

filter rather than simply hiding the field with CSS.

However, do not treat field removal as a complete anti-spam solution.

Spammers can still place URLs inside comment content, send generic promotional messages or use other automated techniques.

A stronger model is:

decide whether comments are needed
↓
remove unnecessary fields
↓
moderate submissions
↓
filter automated spam
↓
review suspicious links
↓
close discussion where it provides no value

For sites that do not need comments at all, disabling the comment system is cleaner than maintaining an increasingly elaborate defense around an unused feature.

For sites that do value discussion, removing the Website field can eliminate one of the most obvious incentives for low-value link spam while preserving the actual conversation.