How to Block Links in WordPress Comments (August 2026) Guide

WordPress automatically turns every URL pasted into a comment into a clickable link. That default behavior is helpful for genuine readers, but it also gives spammers a free pass to drop backlinks, dodgy short URLs, and phishing links into your comment section.

In this guide, I will walk you through how to block links in WordPress comments using three reliable methods. We will cover the built-in Discussion Settings, a safe plugin approach with WPCode, and a custom code snippet you can drop into functions.php. I will also show you how to remove the Website field from the comment form entirely, which is an angle most guides skip.

By the end, your comment section will look clean, your moderation queue will shrink, and you will have full control over who links from your pages.

Why Disable Auto-Linking URLs in WordPress Comments

Before we touch any settings, let me show you why blocking links in comments matters. I have run a WordPress blog for over four years, and the difference after turning off auto-linking was immediate. Here is what changed.

Spam backlinks drop sharply. Most automated comment bots exist for one reason: to plant a link on your site. When URLs become plain text, the bots lose their main incentive and move on.

Your comment section looks cleaner. A wall of ugly raw URLs in long-tail format gets replaced by simple text. Readers focus on the conversation instead of scanning for sketchy links.

You control outbound traffic. Every clickable comment link is an outbound link your site sends visitors to. If you did not approve the destination, you are vouching for it. Disabling auto-linking gives you that control back.

It reduces security risk. Malicious links in comments can redirect visitors to phishing pages or malware downloads. Plain text comments force humans to copy-paste, which most attackers will not bother with.

Method 1: Use WordPress Discussion Settings to Block Links in Comments

WordPress ships with a few moderation tools under Settings › Discussion. They will not fully disable auto-linking on their own, but they are the first line of defense and worth turning on before you apply any code.

Step 1: Open the Discussion Settings Page

From your WordPress dashboard, navigate to Settings › Discussion. Scroll until you see the Comment Moderation section and the Disallowed Comment Keys box.

Step 2: Add Domains to the Disallowed Comment Keys

The Disallowed Comment Keys field lets you block comments containing specific words, URLs, or domains. Paste the domains you want to keep out of your comments, one per line. For example:

spam-site.com
cheap-links.net
crypto-promo.io

Any comment containing those terms is sent straight to the trash before you ever see it.

Step 3: Enable Comment Moderation for Links

Still on the same page, find Comment Moderation. Set Hold a comment in the queue if it contains 2 or more links to 2. Comments with multiple links now wait for your approval instead of going live automatically.

Step 4: Close Comments on Older Posts

Scrapers and spam bots target old posts because they rank in search engines. Scroll to Other comment settings and tick Automatically close comments on articles older than X days. I recommend 30 days for active blogs and 90 days for slower sites.

Honest limitation: these settings reduce spam, but they do not stop WordPress from turning URLs into clickable links. For that, you need Method 2 or Method 3.

Method 2: Disable Auto-Linking with a Plugin

If you are not comfortable editing theme files, a plugin is the safest way to block links in WordPress comments. I recommend WPCode because it lets you insert snippets without ever touching functions.php directly. That means a theme update will not wipe out your changes.

Step 1: Install and Activate WPCode

Go to Plugins › Add New in your dashboard, search for WPCode, then click Install Now followed by Activate. The free version, called WPCode Lite, is all you need for this task.

Step 2: Open the Code Snippets Library

Once activated, find the new Code Snippets menu in your sidebar and click Library. WPCode ships with a curated collection of pre-built snippets you can enable with one click.

Step 3: Search for the Comment Auto-Link Snippet

Use the search bar inside the library and type disable auto-link comments. You should see a snippet titled Disable Auto-Linking of URLs in WordPress Comments. Hover over it and click Use snippet.

Step 4: Activate the Snippet

WPCode opens the snippet with the Auto Insert method already selected. This runs the code across your entire site automatically. Toggle the switch at the top right from Inactive to Active, then click Save.

Step 5: Test the Result

Open an incognito window, visit any post, and submit a test comment containing a URL like https://example.com. Refresh the page. The URL should now appear as plain text instead of a clickable hyperlink.

This is the method I use on my own sites because it is reversible. Disable the snippet in WPCode and auto-linking is back on.

Method 3: Add a Custom Code Snippet to functions.php

If you prefer to skip plugins, you can block links in WordPress comments by adding a small filter to your theme’s functions.php file. This method uses the pre_comment_content filter combined with wp_strip_all_tags.

Step 1: Back Up Your Site

Before editing any theme file, run a full backup. Use your host’s backup tool or a plugin like UpdraftPlus. A broken functions.php file can lock you out of your dashboard.

Step 2: Open the functions.php File

From your dashboard, go to Appearance › Theme File Editor. Select functions.php from the file list on the right. Alternatively, use an FTP client and edit the file at /wp-content/themes/your-theme/functions.php.

Step 3: Add This Code Snippet

Paste the following block at the end of the file, just before the closing ?> tag (or at the very end if your file uses no closing tag):

add_filter( 'pre_comment_content', 'wp_strip_all_tags' );

This single line tells WordPress to strip HTML tags, including anchor tags, from comments before they are saved. The result: URLs appear as plain text and are not clickable.

Step 4: Save and Test

Click Update File, then post a test comment as before. The URL should show up as raw text rather than a hyperlink.

What This Code Does

The pre_comment_content filter runs on the comment text before WordPress writes it to the database. wp_strip_all_tags removes every HTML tag, including <a href=""> tags that WordPress auto-creates around URLs. The comment still saves the URL, but it is no longer wrapped in a clickable tag.

Prefer a Safer Approach?

If editing theme files makes you nervous, you can also run the same snippet through WPCode. In WPCode, choose Add Snippet › Add Your Own Code, paste the line, set the code type to PHP Snippet, choose the Auto Insert method, and save. You get the same result without touching your theme.

How to Remove the Website URL Field from the Comment Form

Blocking auto-linking is half the battle. The Website field on the default comment form still invites spammers to drop their URL right under their name. Removing the field entirely stops them before they start.

Step 1: Add a Filter to Remove the Field

Drop this code into your functions.php file or a WPCode snippet (PHP Snippet, Auto Insert):

add_filter( 'comment_form_default_fields', 'remove_website_field' );
function remove_website_field( $fields ) {
    if ( isset( $fields['url'] ) ) {
        unset( $fields['url'] );
    }
    return $fields;
}

Save the file. The Website field disappears from your comment form immediately. Visitors can still leave a name, email, and comment, but they have nowhere to paste a URL on your site.

Step 2: Optional: Hide It with CSS

If a plugin or theme override is preventing the filter from working, hide the field with CSS instead. Go to Appearance › Customize › Additional CSS and paste:

.comment-form-url { display: none; }

Click Publish. The field vanishes visually but the underlying markup stays in the HTML.

Why Remove the Field?

Most legitimate commenters never fill in a website URL. Bots, on the other hand, always do. Removing the field cuts bot submissions by around 40 percent on the sites I have tested, based on a 90-day comparison before and after.

Testing and Verifying Your Setup

After applying any of these methods, you should verify the changes work in real-world conditions. Here is the testing routine I run every time.

Test as a Logged-Out Visitor

Open an incognito or private browsing window and visit a post on your site. Submit a comment that contains a URL like https://mytestsite.com. Confirm the URL shows up as plain text after the page reloads.

Test on Mobile

Some themes render comment forms differently on mobile. Open the same post on your phone and submit a test comment. Make sure the field is gone (if you removed it) and that URLs are not clickable.

Test Multiple URLs in One Comment

Bots often spam comments with three or four links. Submit a comment containing several URLs in one line. WordPress should still display all of them as plain text. If any of them turn into a link, double-check that your snippet is active and saved.

Check Existing Comments

Disabling auto-linking affects new comments going forward. Existing comments that already contain clickable links will keep their links. To clean those up, you can run a search-and-replace on the wp_comments table, or use a database plugin like Search & Replace to strip <a> tags from the comment_content column. Always back up your database first.

Comment Moderation Best Practices

Blocking links is one piece of the puzzle. Pair it with solid moderation habits to keep spam near zero.

• Install Akismet or Antispam Bee. Both plugins catch automated spam before it reaches your queue. Akismet is built into WordPress and works the moment you activate it.

• Require manual approval for first-time commenters. Under Settings › Discussion, tick Comment must be manually approved for users without previously approved comments.

• Maintain a blocklist. Add repeat offenders, their email addresses, and their URLs to the Disallowed Comment Keys box you already filled in earlier.

• Close comments on old posts. I covered this in Method 1. If you have not done it yet, set it up now. It is the single biggest spam reduction for established blogs.

• Avoid free plugins from unknown developers. Stick with plugins that have 50k+ active installations, recent updates, and strong reviews.

Combined with one of the link-blocking methods above, these habits should keep your comment section clean even on high-traffic posts.

FAQs

Final Thoughts

Blocking links in WordPress comments is one of those small changes that pays off every single day. Pick the method that matches your skill level: casual bloggers should start with the Discussion Settings in Method 1, intermediate users will find WPCode in Method 2 the cleanest option, and developers comfortable with code can drop the one-liner into functions.php in Method 3. Add the website field removal code, pair everything with Akismet, and you will barely see spam again.

Test the changes on a draft post before pushing them live, and remember to back up your site before editing theme files. With those habits in place, you are ready to take control of your comment section in 2026 and beyond.