It can be sometimes bothersome when, in the Discussion (Comments) dashboard, where the admin can see a list of comments, moving the mouse over a link will cause a preview of that link. Sometimes the preview gets in the way of looking at the comment. This is especially true with spam comments.

And I am also concerned that a link to a page/site that had some 'bad' code would cause a compromise of my site.

Is there a way to disable this 'feature'? Not sure where it is coming from.

  • Are you sure this isn't either a browser feature or coming via a plugin? I can't reproduce this on a fresh install.
    – kero
    Jul 2, 2018 at 22:34
  • The site is using the TwentyTen theme. On the Comments (in admin) screen, hovering over a link causes a window to pop up, with the "W" logo while the preview is being loaded. My first thought is that it is theme-related, but didn't think that themes would affect the Comments admin page. And, as usual, it could be a plugin. So (apparently) there is a hook that can be used to enable the preview. Jul 2, 2018 at 23:44
  • I'm really surprised there's no answer and that this is hard to find via Google. If you have any spam, you at least give them a signal to keep deluging you by visiting their links in whatever form.
    – user68816
    May 26, 2019 at 12:29
  • It does seem to be a core WordPress thing. Having a really hard time finding anything about it, though. Closest so far: en.forums.wordpress.com/topic/…
    – user68816
    May 26, 2019 at 13:05
  • See my answer; I decided to look into this. And am concerned about this apparent vulnerability that Akismet is introducing. May 26, 2019 at 21:47

3 Answers 3


Since version 4.1.6, Akismet has a filter which allows you to disable these "mShots" (the site preview popups):

function disable_akismet_mshots( $value ) {
    return false;
add_filter( 'akismet_enable_mshots', 'disable_akismet_mshots' );
  • Can verify that this works and does exactly what the questioner requested.
    – Tantalus
    Jan 4, 2021 at 15:03
  • This does work to remove the preview (tested on my site). But I believe that there is still a security risk by enabling previews by default. IMHO, previews should be off by default, and only enabled by an option. You answer marked as correct - it does fix the problem, but it doesn't fix the improper 'feature' of Akismet. Jan 4, 2021 at 20:14

This annoying thing is introduced by Akismet.

in wp_content/plugins/akismet/_inc/akismet.js line 89 (akismet 4.1.2) insert a "return;" just after

86: // Show a preview image of the hovered URL. Applies to author URLs and URLs inside the comments.
87: $( '#the-comment-list' ).on( 'mouseover', mshotEnabledLinkSelector, function () {
88:     clearTimeout( mshotRemovalTimer ); 
89: return;
  • Yeah, correct. Figured it out after posting on Akismet support forum. "It's a feature, not a bug." type of response. IMHO, should not be there. Haven't looked at the JS code (and not really an expert on it), but think there should be a way to disable it. Shouldn't be there in the first place. Thanks. Jun 8, 2019 at 17:57
  • To read spammer websites is a feature ? Ha ha... Jun 9, 2019 at 2:14

This is still happening in WP5.2.1. You can verify it by looking at your spam messages (via the Admin, Comments screen) and hovering over a link. When you do wo, a box will pop up with the content of that link.

Using the Inspector, I found the HREF code on the link in the spam comment is similar to this (I obfuscated the domain but left the rest) (and not sure how to wrap the code block below)

    <a href="http://Www.example.com/__media__/js/netsoltrademark.php?d=malyj.info%2F__media__%2Fjs%example.php%3Fd%3D3win8.city%2Findex.php%2Fdownload%2F29-ntc33"
     target="_blank" rel="external nofollow">

And the CSS for the :after element, which comes from Akismet (which is why you only see it on Akismet-caught spam, using the latest version of Akismet), in akismet.css line 42:

table.comments td.comment p a::after {

    content: attr(href);
    color: #aaa;
    display: inline-block;
    padding: 0 1ex;


So the content element of the CSS is displaying the content in the link. And note that the example link above is a php file. Which is concerning....since clicking on the link appears to call some 'download' process. (I have not looked into the code of the link, nor clicked on it.)

....but not as concerning as if the example block was some JS. And more concerning if the JS is trying to do some exploit on your computer - which I don't think would require a click, just a hover to execute. YIKES!

So, the cause seems to be the CSS that Akismet is using is displaying the links' content.

And that doesn't look very safe. Akismet should not be using the content element in the :after CSS block.

** ADDED 4 Jan 2020 **

The answer above (marked as correct) is the solution to the problem. But it should not be necessary to 'filter' that action. That preview should be off by default in the Akismet code. Having that feature on by default is a security risk, IMHO.

(Marked correct answer https://wordpress.stackexchange.com/a/380836/29416 )

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.