AI Webform Guard

AI Webform Guard is a lightweight Drupal module that protects your Webform submissions from spam using AI-powered classification.

Instead of relying on traditional CAPTCHA mechanisms, this module uses Chat-based AI model (via the AI module) to analyze form submissions in real time and decide whether a message is spam or not — based on your custom prompt.

Features

• Seamless integration with Webform module
• Uses LLM-based AI detection to classify submissions
• Configurable AI model and prompt template via UI
• Logs blocked spam attempts if enabled
• Prompt templates support Twig tokens and multilingual rendering
• Exclude specific Webform fields from AI spam evaluation via UI
• Human Iteration. If enabled, flagged submissions require manual confirmation before being allowed. The checkbox appears only for submissions flagged as potential spam.
• Submission Truncation. Maximum words per AI request. Limits how many words from the Webform submission are sent to the AI to reduce token usage. On average, one word equals ~1.3–1.5 tokens. Useful for long forms.
• New: Spam Confirmation Flow (per Webform). If the message is detected as spam, the user can confirm their email address via a new email handler.
  To do this, you must set up a new email confirmation handler using the Webform Email Confirmation Link module and enable the checkbox under the respective webform in AI Webform Guard Fields Settings.
  See the README for details.
• New: Protect your custom forms from spam. You can also protect your custom forms against spam using AI by enabling the ai_form_guard submodule.
  After enabling it, you must enter the ID of the corresponding custom form in the AI Webform Guard Settings.
  On the new configuration page AI Form Guard – Custom Form Fields, you can define fields to be excluded from the spam check, with one field ID per line.
• New:Trusted IPs bypass AI processing via an IP whitelist, repeat spammers are blocked by flood control without AI checks, and configurable token limits reduce API costs.
• New: Spam Probability Threshold. The spam probability threshold is always active and determines when submissions are blocked based on AI-calculated spam probability.50 = Aggressive (block suspicious content, may have false positives), 70 = Balanced (default), 90 = Permissive (only block obvious spam with high confidence).

Requirements

• Webform
• AI module (with a working provider, e.g. OpenAI)

Configuration

1. Go to Configuration → AI Webform Guard. (/admin/config/ai/ai_webform_guard)
2. Enter a prompt to guide the AI model (e.g., "Classify the following submission as Spam or Not Spam.").
3. Select your preferred AI model (optional — uses default otherwise).
4. Save your settings.
5. To exclude specific fields from spam detection:

• Go to Configuration → AI Webform Guard Fields Settings (/admin/config/ai/ai_webform_guard/ai_webform_guard_fields)
• Select the fields you want to ignore for each Webform

How it works

Each time a Webform is submitted, the module:

• Renders your AI prompt (with Twig)
• Appends the form submission data
• Sends it to the selected AI model via chat interface
• Parses the response looking for: Classification: Spam or Classification: Not Spam
• Blocks the submission and logs it if spam is detected

Similar Projects

• Honeypot
• Antibot
• Protect Form Flood Control