Akismet

Akismet checks each submission to a form you protect and blocks the ones it marks as spam. If Akismet can't give an answer, the submission is blocked too. Install and activate XPAC Forms first.

Connect Akismet

If the Akismet plugin is active and has a key, that key is used instead, and Test connection says so. One key covers every form. Admins can see the saved key on this screen.

Add it to a form

Edit the form and open Anti-spam protection.

• Akismet: turn on to check each submission.
• First name field, Last name field, Email field, Website field: tell Akismet who sent it. Left empty, each uses the form's first email field, first website field, or a text field named first name, last name or name, shown as Automatic: …. None means no field fits.

To see a spam verdict, open the form in a logged-out window and submit [email protected] as the email. Akismet never marks a logged-in admin as spam, so always test while signed out.

What Akismet receives

• The sender fields above, and every other answer as one message, except file, hidden and consent fields. Passwords and confirmation fields are never sent.
• The form title, the visitor's IP address, browser, role when logged in, and the page they came from.
• Your site address and language, and the request's headers without cookies, logins or secrets.
• The type contact-form, or signup for a form that creates an account.

Cover this in your privacy notice. Checks from staging and local sites are sent as tests, so they don't teach Akismet. Submissions made in the background, such as a paid Stripe order recovered later, have no visitor and are not checked.

When a submission is blocked

Akismet only checks submissions. It doesn't send them anywhere, so it never appears on the Deliveries screen.

• Spam: the visitor sees your Spam rejection message (XPAC → Forms → Settings → Messages).
• No answer: no key, a rejected key, an error from Akismet, or no reply in 15 seconds. The visitor sees "The spam check couldn't be completed, so your answers were not sent. Please try again later."

Either way the submission goes to the Spam view when Keep submissions marked as spam is on (XPAC → Forms → Settings → Spam and abuse), and sends no email or integration. Spam Akismet calls blatant is dropped instead of kept.

Admins see a notice when a form has Akismet on but no key, when Akismet rejects the key, when it could not check a recent submission, and when Akismet sends a warning about your account, such as going over your plan.

Correct a wrong verdict

Under XPAC → Forms → Submissions, Mark as spam and Not spam report the mistake to Akismet in the background. A report that fails because of a network problem or a busy Akismet is tried up to 3 times. A submission moved out of Spam doesn't send its email or reach integrations.

To report a submission, Akismet needs what it was checked with, so each checked submission keeps the visitor's IP address, browser, role and answers for 15 days. After that they are removed and corrections are no longer reported. Deleting the standalone Akismet plugin removes them along with its settings.

For developers

The key is saved as akismet_api_key in the xpac option. Each form's settings are under akismet in its form_settings meta. Failed checks and reports are written to the PHP error log with the prefix XPAC akismet:, without answers or the key.

Return false from xpac_forms_enable_verification for the provider akismet to skip the check for one submission.