As said in this comment, WordPress has some possibilities to moderate comments and some good plugins for spam prevention.
Nevertheless, if I understand you correctly you would like to prevent the post of comments before it gets to the database.
I think I've found a solution for that.
Check out the code for your functions.php.
function preprocess_comment_spam( $commentdata ) {
$spamwords = array( 'href', '[url', 'spamword' );
foreach( $spamwords as $spam ) {
if ( \strpos( $commentdata['comment_content'], $spam ) !== false ) {
wp_die('Sorry, we detected some spam.'); // This is the Error Notice for Wordpress.
/*return new WP_Error( 'spam_detected', __( 'Sorry, we detected some spam.' ), 403 );*/
}
}
return $commentdata;
}
add_filter( 'preprocess_comment' , 'preprocess_comment_spam' );
I did not test the code, but it should work.
Here you have more informations about this filter: https://developer.wordpress.org/reference/hooks/preprocess_comment/