Akismet

Classify XPAC Forms submissions with Akismet while keeping credentials write-only and failures reviewable.

Akismet adds server-side spam classification to Forms. A protected form sends selected context and answers to Akismet during validation. A spam verdict or an operational verification failure refuses the normal submission path.

Forms is required

This add-on does not register its editor panel or validation check unless XPAC Forms is active.

Configure the API key

Akismet resolves one key in this order:

the key from the official Akismet plugin, when that plugin is connected;
the password-masked key under XPAC → Integrations → Akismet.

The XPAC settings field explains this precedence. One key serves every form.

Connect the official Akismet plugin, or obtain a key from Akismet and save it under XPAC → Integrations → Akismet.

Edit a form and open Anti-spam protection.

Enable Akismet and optionally map the visitor's first name, last name, email address, and website URL.

Update the form and submit a realistic test.

The mappings may be left empty. A mapped answer is placed in Akismet's named author field; other eligible answers are combined into comment_content.

Enabled protection fails closed without a key

The editor keeps the Akismet control visible and shows a non-dismissible error when no key is available. The server refuses and marks submissions rather than silently allowing an enabled form to run unchecked. An administrator notice and the PHP error log also identify the configuration failure.

Data sent to Akismet

The request can contain:

Akismet field	Source
`comment_author`	Mapped first and last name, joined as text.
`comment_author_email`	Mapped email answer.
`comment_author_url`	Mapped URL answer.
`comment_content`	Other eligible submitted answers, flattened to text.
`contact_form_subject`	Form title.
`comment_author_IP`, `user_ip`	Visitor IP address.
`permalink`, `referrer`	Referring page.
`user_agent`	Browser user agent.
`user_role`	Logged-in visitor roles, when present.
`blog`, `blog_lang`, `blog_charset`	Site URL, locale, and charset.
`comment_type`	Fixed value `xpac-forms`.

Password and confirmation controls are write-only: they are excluded from mapping choices, the named fields, comment_content, and the submission copy exposed to Akismet extension hooks. Undeclared request keys are excluded too. File metadata arrays are not rendered into classifier text.

Other submitted answers—including free text and consent choices—may leave your server. Enable Akismet only where this processing matches the form's privacy notice and your Akismet terms.

xpac_akismet_comment_check_data can remove additional request fields immediately before the HTTP call. Its Submission argument is a redacted copy and does not contain password, confirmation, or undeclared request values.

Verification, failure, and recovery

The check runs after local Forms validation and before entry storage, emails, or integration delivery. The request timeout defaults to 15 seconds and is clamped to 1–30 seconds. A fast transport failure is retried once; a request that consumed its whole timeout is not repeated.

Only an HTTP 200 response with Akismet's exact true or false verdict is accepted:

false means not spam and the normal submission continues;
true means spam and the submission is refused;
transport, HTTP, provider-error-header, or malformed-verdict failures fail closed.

Operational failures are logged with an XPAC akismet prefix without submitted answers or credentials.

With Forms' default Keep submissions marked as spam setting enabled, refused submissions are quarantined in the Spam view. Notification emails and external deliveries do not run, but an administrator can review and restore a false positive. Turning that Forms setting off drops refused content instead.

This check is synchronous

The visitor waits for Akismet because the verdict decides whether Forms may accept the submission. Keep Forms throttling enabled, monitor provider availability, and choose a timeout appropriate for the site. A CAPTCHA or Honeypot can provide a separate layer; no single anti-spam service guarantees correct classification.

Developer reference

The fallback key is stored in the xpac option as akismet_api_key. Per-form state is stored under akismet in the form's form_settings meta:

{
	"akismet": {
		"enable": true,
		"fieldsMap": {
			"comment_author_first_name": "first-name",
			"comment_author_last_name": "last-name",
			"comment_author_email": "email",
			"comment_author_url": "website"
		}
	}
}

xpac_akismet_request_timeout filters the timeout before its 1–30-second clamp. xpac_forms_enable_verification can skip Akismet for a narrowly scoped special submission; the provider slug is akismet. The filter receives a callback-safe submission copy. A missing key is checked before this bypass and still fails closed.

xpac_akismet_missing_api_key fires with the same redacted copy when an enabled form has no key. It is an operational notification hook, not a bypass.

Configure the API key

Data sent to Akismet

Verification, failure, and recovery

Developer reference

On this page