The website field is covered by the "Edit profile" permission, so you could remove that. But beyond that, there isn't really a way to block just URLs in those specific areas.
I have found that using an expression in custom user fields seems to work, but I imagine it isn'y possible to implement that in the default fields. Perhaps I should suggest it.