Every link you publish is a small vote. Search engines have treated outbound links that way for two decades: point at a page and you pass it a sliver of your site’s credibility. That’s fine when you’re linking to a source you trust. It’s a problem when the link is an ad you got paid for, an affiliate URL, or something a stranger dropped in your comments at 3am.
The fix is a tiny attribute on the anchor tag: rel="nofollow", and its two newer siblings, rel="sponsored" and rel="ugc". Get them right and you tell Google exactly which links you stand behind and which you don’t. Get them wrong — or ignore them on a monetized site — and you’re either leaking ranking signal to spam or quietly violating Google’s link guidelines without realizing it.
Here’s what each one actually does, what WordPress already handles for you automatically, and where you still have to reach for the attribute yourself.
What the rel Attribute Is Actually For
The rel attribute on an <a> tag describes the relationship between your page and the page you’re linking to. Most of the time you never touch it, and the link just passes normal ranking signal — what people loosely call “link juice.” The link-qualification values are how you annotate the exceptions.
Google introduced rel="nofollow" back in 2005, originally as a weapon against comment spam. The idea was blunt: if a link carried nofollow, Google wouldn’t follow it for ranking purposes and wouldn’t pass credit to the target. Spammers flooding blog comments with links to their own sites suddenly got nothing out of it.
That single attribute did a lot of jobs for fourteen years. Then in September 2019 Google split it into three, because “I don’t fully endorse this link” and “I got paid for this link” are genuinely different statements that deserve different labels.
nofollow — the general “I don’t vouch for this”
rel="nofollow" still exists and still means what it always did: you’re linking to something, but you don’t want to pass an endorsement. Use it for links you can’t fully vet, references you’re citing critically, or any destination you’d rather not stake your site’s reputation on.
sponsored — paid, affiliate, and advertising links
If money changed hands for a link — a display ad, a paid placement, a sponsored post, or an affiliate URL that pays you a commission — that link should carry rel="sponsored". This is the attribute the FTC’s disclosure expectations and Google’s own guidelines are both pointing at. Marking paid links keeps you on the right side of Google’s link spam policies, which treat undisclosed paid links as a form of manipulation.
ugc — user-generated content
Links your users create rather than you — blog comments, forum posts, profile fields, reviews — get rel="ugc". It signals “a visitor put this here, not the site owner,” which lets Google weigh it accordingly without you having to blanket-nofollow every link a reader ever leaves.
These labels aren’t just SEO hygiene anymore. On a site that runs ads or affiliate links, a missing sponsored attribute is the kind of thing Google’s spam systems are built to catch. And on a site with open comments, the difference between annotated and unannotated user links is the difference between a spammer wasting their time and a spammer borrowing your rankings to boost their own.
They’re Hints Now, Not Hard Rules
This is the part most older tutorials get wrong, so it’s worth stating plainly. When Google announced sponsored and ugc in September 2019, it also changed how it treats all three attributes. As of September 10, 2019, Google uses them as hints for ranking purposes, and as of March 1, 2020, they became hints for crawling and indexing too.
A hint is not a command. Google reserves the right to look at a nofollow link and decide it’s worth following anyway — say, to understand context or discover a page it wouldn’t otherwise find. In practice that means you should never treat nofollow as a security boundary or a way to hide a page. If you genuinely need a URL kept out of the index, that’s a job for noindex or authentication, not for a link attribute. We covered exactly that distinction in the noindex guide, and it’s the single most common misconception about how these attributes work.
You can also stack them. A paid link inside a comment could legitimately be rel="sponsored ugc", and Google explicitly supports multiple values in one attribute. Order doesn’t matter; space-separate them and move on.
What WordPress Already Does For You
Here’s the good news, and it’s the reason most site owners never think about any of this: WordPress core handles the highest-risk case automatically. Comments are where link spam lives, and core has been auto-tagging comment links since version 5.3, released in November 2019 — right after Google shipped the new attributes.
When someone leaves a comment with a link in the body, core runs it through a function called wp_rel_ugc() on the pre_comment_content filter before the comment is ever saved. That function rewrites every anchor in the comment to carry rel="nofollow ugc". The commenter’s “website” field — the link attached to their name — gets rel="ugc" on its own, plus external nofollow when the URL points off your domain.
So out of the box, a default WordPress install is already doing the right thing with the links it has the least control over. You don’t need a plugin, a snippet, or a setting for comment links. That part is genuinely solved.
Since WordPress 5.3, links inside comment text automatically get rel="nofollow ugc", and comment author links get rel="ugc" (with external nofollow added for off-site URLs). It happens on save, in core, with no plugin. The comment spam that rel="nofollow" was invented to fight is the one case you don’t have to think about.
Where core stops helping
The gap is your own content. Links you place inside a post or page pass full ranking signal by default, and that’s correct — those are your editorial links, the ones you do vouch for. But the moment one of those links is an affiliate URL, a paid mention, or a review-swap arrangement, core won’t touch it. It has no idea money was involved. Tagging those is entirely on you.
The block editor doesn’t make this obvious, either. When you add a link in the standard link toolbar, there’s no “nofollow” or “sponsored” checkbox in core — you either edit the block’s HTML directly to add the rel attribute, or you install an SEO plugin that adds those toggles to the link UI. It’s a small omission that trips up a lot of people who assume WordPress must have a switch for it somewhere.
How to Add These Attributes Yourself
Editing a single link by hand
The most direct route is the block editor’s code view. Select the paragraph block, open the block options (the three-dot menu), and choose Edit as HTML. Find your anchor and add the attribute:
<a href="https://example.com/product" rel="sponsored">our recommended tool</a>
Switch back to visual editing and you’re done. This is fine for the occasional affiliate link, and it’s the approach I reach for when a post has one or two monetized links rather than dozens.
Using an SEO plugin’s link toggle
If you add sponsored or affiliate links regularly, a plugin that surfaces rel options right in the link popover saves a lot of HTML spelunking. Most major SEO plugins add a small “mark as nofollow / sponsored” control when you insert a link, and some affiliate-link managers cloak and tag URLs in bulk. Pick whichever fits how you actually publish — the goal is that adding the attribute stops being a thing you forget.
Bulk-fixing links across an existing site
If you’re retrofitting a site that has years of untagged affiliate links, a manual pass through hundreds of posts isn’t realistic. This is where WP-CLI earns its keep. You can search your content for known affiliate domains and audit which links need attention:
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%amzn.to%' AND post_status='publish';"
That gets you a list of every published post linking to a given affiliate domain, so you can prioritize the ones that matter instead of guessing. For the rewrite itself, a serialization-aware tool like wp search-replace can swap link patterns safely, though I’d test any bulk rewrite on a staging copy first — regex against live post content is exactly the kind of thing that looks clean until it isn’t.
General “I don’t fully endorse this link.” Untrusted references, links you can’t vet.
Any link where money or value changed hands — ads, paid placements, affiliate URLs.
User-generated links — comments, forum posts, reviews. WordPress adds this to comments for you.
The Mistakes That Actually Cost You
A few patterns come up again and again, and they’re worth naming because none of them are obvious from the outside.
Nofollowing your own internal links
Some people, worried about “wasting” ranking signal, slap nofollow on links between their own pages. Don’t. Internal links are how ranking signal flows through your site and how Google discovers your deeper pages, and the old “PageRank sculpting” trick they’re imitating stopped working many years ago. Let your internal links pass normally — they’re the ones you most want Google to follow.
Treating nofollow as a privacy setting
Because these are hints, a nofollow link can still be crawled, and the page it points at can still be indexed through some other route entirely. If a URL must stay out of search results, use noindex or put it behind a login. A link attribute was never designed to hide anything.
Forgetting affiliate links exist
This is the big one for monetized sites. A post written in 2021 with a bare affiliate link doesn’t magically get tagged when Google tightens its policies in 2026. The last comment-spam cleanup we did on a client site turned up something adjacent: an injected block of hidden outbound links a compromised plugin had been quietly adding to old posts, none of them tagged, all of them pointing at pharma-spam domains. The site had been passing real ranking signal to a spam network for months without anyone noticing. Tagging is easy; the hard part is knowing which of your old links even need it.
Over-tagging out of caution
The opposite failure is treating nofollow as a default and applying it to every external link you publish. Editorial links to genuine sources are good for your readers and fine for your SEO. Reserve the attributes for the cases they describe — paid, user-generated, or genuinely untrusted — and let your honest citations flow.
A Simple Policy That Holds Up
You don’t need a decision tree taped to your monitor. The rule that covers almost every real case fits in three lines. If money was involved, it’s sponsored. If a visitor created the link, it’s ugc — and WordPress already does that one for you on comments. If you just don’t want to vouch for it, it’s nofollow. Everything else is a normal editorial link, and those are the whole point of the web.
Set that policy once, wire it into how you publish — a plugin toggle, a code-view habit, whatever sticks — and the attributes stop being something you agonize over per link. They become a reflex, which is exactly what they were meant to be.
Frequently Asked Questions
Not sure which of your old links need tagging? A quick audit of your outbound and affiliate links is one of the cheapest SEO wins there is — and a good excuse to check nothing else has crept into your content while you weren’t looking.
Built by amplifi.studio — see also our WordPress internal linking guide.