{"id":2165,"date":"2026-10-15T13:13:17","date_gmt":"2026-10-15T17:13:17","guid":{"rendered":"https:\/\/tim.cexx.org\/?p=2165"},"modified":"2026-10-15T13:13:17","modified_gmt":"2026-10-15T17:13:17","slug":"disable-website-url-comment-field-in-wordpress-2026-and-shed-some-tears","status":"publish","type":"post","link":"https:\/\/tim.cexx.org\/?p=2165","title":{"rendered":"Disable Website\/URL Comment Field in WordPress 2026 (and shed some tears)"},"content":{"rendered":"\n<p><em>TL;DR: Jump to the <a href=\"#remove_url_field\">instructions<\/a>.<\/em><\/p>\n\n\n\n<p>I don&#8217;t want to say that the AIPocalypse has ended the era of the open web, but&#8230;yeah.<\/p>\n\n\n\n<p>Actual live human visitors have dropped to near-zero and all my bandwidth is being sucked up by AI company scrapers, but if this isn&#8217;t bad enough, apparently it&#8217;s now economical to spend the tokens for agentic LLMs to generate unique, one-off, topical, artisanal, bespoke comment spams <em>at scale<\/em> that bypass the usual crowdsourced spam mitigations. This tiny blog is one of the last gasps of the Old Web that allows semi-anonymous, account-free commenting (so far), but as of today I&#8217;ve made the unfortunate decision to completely disable hyperlinks in comments in an effort to stem the flood, including removal of the URL field entirely. If you&#8217;re in the same bot-boat, skip below for instructions on how to disable the URL (website) field, which is not normally an option available through WordPress&#8217;s configuration options.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"573\" height=\"1024\" src=\"https:\/\/tim.cexx.org\/wp-content\/uploads\/ai_comment_spam-573x1024.png\" alt=\"\" class=\"wp-image-2166\" srcset=\"https:\/\/tim.cexx.org\/wp-content\/uploads\/ai_comment_spam-573x1024.png 573w, https:\/\/tim.cexx.org\/wp-content\/uploads\/ai_comment_spam-168x300.png 168w, https:\/\/tim.cexx.org\/wp-content\/uploads\/ai_comment_spam.png 738w\" sizes=\"auto, (max-width: 573px) 100vw, 573px\" \/><figcaption class=\"wp-element-caption\"><em>The inevitable bespoke-AI-comment-spam juggernaut finally comes for little old me<\/em><\/figcaption><\/figure>\n\n\n\n<p>These examples are taken from the latest WordPress 6.x branch (pre-AI-features<sup data-fn=\"6263bc60-6217-4da3-9d56-d4e177c1bb19\" class=\"fn\"><a href=\"#6263bc60-6217-4da3-9d56-d4e177c1bb19\" id=\"6263bc60-6217-4da3-9d56-d4e177c1bb19-link\">1<\/a><\/sup>), but should work on 7+ just as well.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">First: Disable URLs in Comment Text<\/h2>\n\n\n\n<p>You&#8217;ve probably tried this already, but just for completeness: WordPress has builtin comment moderation settings. They&#8217;re pretty basic, but there is a setting to automatically moderate comments that contain any (configurable number of) links. Note this applies to the comment <em>text<\/em> field only, and ignores Author URLs.<\/p>\n\n\n\n<p>Under Dashboard > Settings > Discussion, edit the Comment Moderation field to &#8220;<strong>Hold a comment in the queue if it contains [_1_] or more links.<\/strong>&#8221; Early spambots would try to stuff hundreds-thousands of links in a single post, but those I&#8217;ve seen in the modern area are wise to this setting and stick to 0-1 (more on &#8216;0&#8217; in a bit). Note entering zero AFAIK moderates all comments, which there is already a setting for and may not be what you intended (so far, the endgame of most comment spam is to insert a link, though this <a href=\"https:\/\/tim.cexx.org\/?p=2009\">will change<\/a>). Note, this is a builtin setting and does not require installing any plugins. Plugins purporting to merely replicate this feature are suspicious at best. There is another class of plugins aimed at preventing URLs in comments from being automatically rendered into clickable links, but this won&#8217;t actually stop the spam comments from flooding in unmoderated.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"487\" src=\"https:\/\/tim.cexx.org\/wp-content\/uploads\/image-4-1024x487.png\" alt=\"\" class=\"wp-image-2167\" srcset=\"https:\/\/tim.cexx.org\/wp-content\/uploads\/image-4-1024x487.png 1024w, https:\/\/tim.cexx.org\/wp-content\/uploads\/image-4-300x143.png 300w, https:\/\/tim.cexx.org\/wp-content\/uploads\/image-4-768x365.png 768w, https:\/\/tim.cexx.org\/wp-content\/uploads\/image-4.png 1119w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Builtin comment URL moderation settings; beware this applies to the comment text only, not author URLs.<\/em><\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"remove_url_field\">Second: Remove Comment URL Field<\/h2>\n\n\n\n<p>More <em>on-trend<\/em> spambots, AI-or-not, are adaptive and will reduce the number of links in the post body (including to zero) when they notice their posts aren&#8217;t appearing. These will instead be content to put the spam URL in the &#8216;Author URL&#8217; or Website field, which cannot be turned off via WordPress menu options and is not subject to any moderation settings.<\/p>\n\n\n\n<p>The low-budget way to thwart this spam is to remove the field entirely, both from view and from ingestion by WordPress (for those bots that know a field by this name &#8216;should&#8217; exist and will try to post content for it anyway). Sucks for those last-remaining human commenters, but I guess they can still hint at their URL in the comment body if they really need to.<\/p>\n\n\n\n<p>As always, there are plugins on the WordPress marketplace purporting to do this (and more), but it&#8217;s dirt-easy to create your own DIY plugin (it&#8217;s just a few lines of copy-paste) and save your blog&#8217;s attack surface from sketchy or unmaintained 3rd party plugins (h\/t <a href=\"https:\/\/wordpress.stackexchange.com\/a\/3201\">this stackOverflow answer<\/a>):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create a folder<sup data-fn=\"a43cbb10-51d1-473a-a9a4-cc1c9bf6450d\" class=\"fn\"><a href=\"#a43cbb10-51d1-473a-a9a4-cc1c9bf6450d\" id=\"a43cbb10-51d1-473a-a9a4-cc1c9bf6450d-link\">2<\/a><\/sup> on your hard disk and give it a descriptive name, e.g. &#8216;disable_comment_url&#8217; .<\/li>\n\n\n\n<li>Create a text file in this folder and paste the following code into it:<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<pre class=\"wp-block-code\"><code><mark style=\"background-color:rgba(0, 0, 0, 0);color:#fcb900\" class=\"has-inline-color\">&lt;?php\n\/*\nPlugin Name: Get Rid of Comment Websites\n*\/\nfunction my_custom_comment_fields( $fields ){\n  if(isset($fields&#91;'url']))\n    unset($fields&#91;'url']);\n  return $fields;\n}\n\nadd_filter( 'comment_form_default_fields', 'my_custom_comment_fields' );<\/mark><\/code><\/pre>\n<\/blockquote>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Rename the textfile with a .php extension and a descriptive name, e.g. &#8216;disable_comment_url.php&#8217;<\/li>\n\n\n\n<li>Zip the new folder into a .zip file<\/li>\n\n\n\n<li>Upload the .zip file as a &#8216;plugin&#8217; in the WordPress dashboard (Plugins &gt; Add Plugin &gt; Upload Plugins).<\/li>\n<\/ul>\n\n\n\n<p>Yes, it&#8217;s that easy. It will now show up as a real plugin in the WP dashboard, with activate\/deactivate\/delete controls, that will not get clobbered by routine WP or theme upgrades (unlike advice that just has you hand-edit the filter into functions.php or similar; don&#8217;t do that). The name that appears in the dashboard is set by the &#8216;Plugin Name:&#8217; line, very oldschool and I love it.<\/p>\n\n\n\n<p>Tada, the Website (Author URL) field should disappear from the comment form.<\/p>\n\n\n<ol class=\"wp-block-footnotes\"><li id=\"6263bc60-6217-4da3-9d56-d4e177c1bb19\">Yes, WordPress user from all the way back in the <a href=\"https:\/\/thehistoryoftheweb.com\/the-story-of-wordpress\/\">b2\/b2evolution<\/a> era still rocking 6.x for now. Without unduly bagging on AI-the-tool, the nonconsensual injection of it everywhere isn&#8217;t something I care to endorse, and the potentially broadened attack surface created by this functionality (moreso than the typical &#8216;new release&#8217; shakeout) isn&#8217;t something I want. Eventually 6.x will be sufficiently unsupported that the calculus will shift, but that day isn&#8217;t today. <a href=\"#6263bc60-6217-4da3-9d56-d4e177c1bb19-link\" aria-label=\"Jump to footnote reference 1\">\u21a9\ufe0e<\/a><\/li><li id=\"a43cbb10-51d1-473a-a9a4-cc1c9bf6450d\">The folder is technically optional, but follows WP plugin conventions a bit better. <a href=\"#a43cbb10-51d1-473a-a9a4-cc1c9bf6450d-link\" aria-label=\"Jump to footnote reference 2\">\u21a9\ufe0e<\/a><\/li><\/ol>","protected":false},"excerpt":{"rendered":"<p>TL;DR: Jump to the instructions. I don&#8217;t want to say that the AIPocalypse has ended the era of the open web, but&#8230;yeah. Actual live human visitors have dropped to near-zero and all my bandwidth is being sucked up by AI company scrapers, but if this isn&#8217;t bad enough, apparently it&#8217;s now economical to spend the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2176,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_FSMCFIC_featured_image_caption":"","_FSMCFIC_featured_image_nocaption":"","_FSMCFIC_featured_image_hide":"","iawp_total_views":10,"footnotes":"[{\"content\":\"Yes, WordPress user from all the way back in the <a href=\\\"https:\/\/thehistoryoftheweb.com\/the-story-of-wordpress\/\\\">b2\/b2evolution<\/a> era still rocking 6.x for now. Without unduly bagging on AI-the-tool, the nonconsensual injection of it everywhere isn't something I care to endorse, and the potentially broadened attack surface created by this functionality (moreso than the typical 'new release' shakeout) isn't something I want. Eventually 6.x will be sufficiently unsupported that the calculus will shift, but that day isn't today.\",\"id\":\"6263bc60-6217-4da3-9d56-d4e177c1bb19\"},{\"content\":\"The folder is technically optional, but follows WP plugin conventions a bit better.\",\"id\":\"a43cbb10-51d1-473a-a9a4-cc1c9bf6450d\"}]"},"categories":[1],"tags":[68,15,56],"class_list":["post-2165","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","tag-ai","tag-corporates","tag-spam"],"_links":{"self":[{"href":"https:\/\/tim.cexx.org\/index.php?rest_route=\/wp\/v2\/posts\/2165","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tim.cexx.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tim.cexx.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tim.cexx.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tim.cexx.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2165"}],"version-history":[{"count":6,"href":"https:\/\/tim.cexx.org\/index.php?rest_route=\/wp\/v2\/posts\/2165\/revisions"}],"predecessor-version":[{"id":2177,"href":"https:\/\/tim.cexx.org\/index.php?rest_route=\/wp\/v2\/posts\/2165\/revisions\/2177"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tim.cexx.org\/index.php?rest_route=\/wp\/v2\/media\/2176"}],"wp:attachment":[{"href":"https:\/\/tim.cexx.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2165"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tim.cexx.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2165"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tim.cexx.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2165"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}