Is this an infection or just spam that got through?

Almost always the latter — a comment containing a bad link cleared moderation. Nothing on your server was compromised; delete the comment and the finding is resolved. It becomes a site problem only when moderation was supposed to catch it and did not.

How do I stop these arriving at all?

Require moderation for first-time commenters (WordPress's default), enable a spam filter such as Akismet, and consider closing comments on posts older than some months — old posts attract the bulk of comment spam. If the site never uses comments, disable them globally and this class of finding disappears.

Hundreds of these appeared at once. What then?

A bot found the comment form. Bulk-delete from the WordPress comments screen filtered to pending or spam, then add friction — a spam filter, moderation, or closing comments — before the next wave. The volume is annoying but each item is still just a comment; no cleanup beyond deletion is needed.

Glossary · Malware

A malicious URL was found in a comment

Wordfence type: commentBadURL
Category: Malware
Severity: Medium

A comment on the site links to a known-bad domain.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

Comment with author "BestSeoOffers" contains a suspected malware URL.

What Wordfence found

Wordfence checked comment content against its URL blocklist and found a match. Unlike an injection, this often arrives through the ordinary comment form.

Why it matters

It is usually spam rather than a compromise, but published comments linking to malware still expose visitors and damage the site's standing with search engines. Volume matters more than any single comment: a flood suggests moderation is off.

How to fix it

1Delete the comment rather than marking it as spam if it is already published.
2Check comment moderation settings — require approval for first-time commenters at minimum.
3If there are many, look at whether a plugin is auto-approving.
4Consider disabling comments entirely on sites that do not use them.

Common questions

Is this an infection or just spam that got through?: Almost always the latter — a comment containing a bad link cleared moderation. Nothing on your server was compromised; delete the comment and the finding is resolved. It becomes a site problem only when moderation was supposed to catch it and did not.
How do I stop these arriving at all?: Require moderation for first-time commenters (WordPress's default), enable a spam filter such as Akismet, and consider closing comments on posts older than some months — old posts attract the bulk of comment spam. If the site never uses comments, disable them globally and this class of finding disappears.
Hundreds of these appeared at once. What then?: A bot found the comment form. Bulk-delete from the WordPress comments screen filtered to pending or spam, then add friction — a spam filter, moderation, or closing comments — before the next wave. The volume is annoying but each item is still just a comment; no cleanup beyond deletion is needed.

How WPSecureOps treats it

The connector reports this as commentBadURL. WPSecureOps files it under Malware and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.