Spammers attacking my WordPress Site – Removing URL field from core? [closed]

The decision about comment status upon posting is made by wp_allow_comment() function.

There is a filter in it that can be used to change it accordingly. Basic form would look something like this (not tested):

add_filter( 'pre_comment_approved', function( $approved, $commentdata ) {

    if ( ! empty( $commentdata['comment_author_url'] ) ) {
        return 'spam';
    }

    return $approved;
}, 10, 2 );

This probably needs to be refined though, since it will probably interfere with users registered on site, who have URL set in profile.