Does WordPress add nofollow to comment links?

The three kinds of comment link

A comment can contain links in three places, and core handles each.

1. The author's website. If a commenter fills in the Website field, their name becomes a link. Core builds its rel like this: always ugc; plus external nofollow when the address is on another site. A commenter who enters a page on your own domain gets rel="ugc" only.

<a href="https://their-site.example/" class="url" rel="ugc external nofollow">Sam</a>

2. Links typed as HTML in the comment. When a comment is submitted, a filter rewrites every <a> in its text to carry rel="nofollow ugc" before the comment is saved. The attribute is stored in the database with the comment.

3. Bare URLs. A plain https://... pasted into a comment is turned into a clickable link when the comment is displayed. In a comment, that generated link gets ugc, and nofollow too when it points off-site.

This applies to everyone who comments through the form. An administrator replying on their own post gets the same attributes as an anonymous visitor.

Separately, the Reply links under each comment carry rel="nofollow". Those point at your own page with a ?replytocom= parameter and are marked so crawlers do not chase them.

What nofollow and ugc mean to Google

nofollow says "do not associate my site with this link". ugc says "this link is in user-generated content". Google introduced ugc and sponsored alongside nofollow and treats all three as hints about which links to leave out of its link calculations. Its documentation recommends ugc for comments and forum posts, which is exactly what WordPress outputs.

For you as the site owner, the effect is protective. Links dropped by commenters, whether sincere or spam, are not counted as your recommendations. Google's spam policies place responsibility for user-generated spam on the site hosting it, and marking the links is one of the listed ways to prevent abuse.

For commenters hoping for a backlink, it means comment links are close to worthless for ranking, which is the point.

What core does not touch

• Links in posts and pages. Core adds no rel to links you write. They are followed normally.
• Links in widgets, menus and theme templates. Untouched.
• Old comments. Because the rel for typed links is written when a comment is saved, comments imported from another system or created by code that bypasses the normal filters may lack it. Author links and bare URLs are handled at display time, so those are always covered.

To mark a link in your own content, set it per link. In the block editor's link settings you can add the values yourself in the HTML, and Hydrogen SEO's Nofollow External Links switch in general settings adds rel="nofollow" to every external link in content. We suggest leaving that off and marking only paid or untrusted links individually, with sponsored for anything paid.

Is the default enough against comment spam?

It removes the ranking incentive, not the spam. Spammers post anyway, hoping for clicks or not caring. Visible spam is a quality problem whatever its rel says, and a page filled with junk links can draw the manual action Google calls user-generated spam.

So keep the standard defences on:

• Hold first-time commenters for moderation. Under Settings → Discussion, "Comment author must have a previously approved comment" is the sensible default.
• Limit links. The same screen holds a comment in the queue when it contains a set number of links, 2 by default. Lower it to 1 if you get link spam.
• Use a spam filter, and empty the spam folder now and then.
• Close comments on old posts if they attract only spam, using "Automatically close comments on posts older than N days".
• Consider removing the Website field from the comment form. Fewer reasons to spam, and nothing of value is lost.

If you want to reward real contributors by removing nofollow from their links, that needs a plugin or a filter on the comment author link, and it reopens the incentive. Most sites should leave the default alone.

To check your own pages, open a post with comments, view the source and search for rel="nofollow ugc" and rel="ugc external nofollow".