Akismet Antispam

Frictionless spam protection for comments, contact forms, Webform submissions, and user registrations using the Akismet cloud service.

Akismet checks user-submitted content against a global spam database maintained by Automattic, the company behind WordPress.com. When someone posts a comment, fills out a contact form, submits a Webform, or registers an account, Akismet analyzes the submission and returns a verdict: ham (legitimate), spam, or discard (blatant spam). You decide what happens next.

The module is designed to work quietly in the background. Legitimate users are never interrupted. Spam is caught before it reaches your inbox or clutters your comment threads.

Features

- Spam checking for comments, contact forms, Webform submissions, and user registrations
- Three-tier verdicts: ham, spam, and discard (blatant spam that can be dropped immediately)
- Comment spam queue with bulk moderation actions
- Per-comment "Mark as Spam" and "Not Spam" feedback, which improves Akismet's accuracy over time
- Bot-detection signals sent alongside each check (honeypot, nonce, JavaScript timing)
- Automatic recheck of submissions that failed due to API errors
- Scheduled cleanup and purge of old spam
- Drush commands for diagnostics, recheck, purge, and GDPR operations
- GDPR-compliant data export and erasure by email address
- Circuit breaker for API resilience during outages
- Fail-open design: if the Akismet API is unreachable, submissions are never blocked

Post-Installation

After enabling the module, go to Administration > Configuration > Content authoring > Akismet (/admin/config/content/akismet) and enter your API key. You can get a key at https://akismet.com/signup/.

On the same page, choose which form types to protect: comments, contact forms, and user registrations each have their own toggle. For Webform, add the Akismet handler to individual forms through the Webform UI.

The module ships with three permissions you can assign to roles:
- "Administer Akismet" for access to settings and maintenance operations
- "Use Akismet moderation" for managing the spam queue and sending feedback
- "Bypass Akismet" for trusted roles that should skip spam checking entirely

Once configured, spam checking happens automatically on form submission. Caught spam appears in the comment spam queue at Administration > Content > Comments > Spam.

Additional Requirements

- PHP 8.1 or higher
- An Akismet API key (free for personal sites, paid plans for commercial use) from https://akismet.com/
- The automattic/akismet-sdk PHP package, which is installed automatically when you install this module via Composer

You must install this module with Composer. The Drupal.org tarball does not include third-party PHP dependencies. If you download the module manually, the SDK will be missing and the module will not function. The status report page will show an error explaining how to fix this.

Recommended modules/libraries

- Webform - Adds a Webform handler for per-form spam protection on custom forms.
- Contact Storage - Stores contact submissions as entities, which lets you send spam/ham feedback to Akismet and use moderation actions on contact messages.
- Key - Store your API key in an environment variable or file instead of the database.
- Akismet also works alongside other anti-spam modules like Honeypot, CAPTCHA, and Antibot. When these modules are installed, Akismet detects them and validates after they do, so you get layered protection without conflicts.

Similar projects

- The existing Akismet module on Drupal.org is an unofficial community project last released as a 2.0.0 alpha in April 2023. It supports Drupal 9/10 but has seen minimal activity, with only one new issue filed in the past two years. This module is a ground-up rewrite by the Akismet team at Automattic, with full Drupal 10.3+/11/12 support, comprehensive test coverage, and active maintenance. Moving a site over from it? Follow Migrating from the community Akismet module.
- Mollom provided similar cloud-based spam filtering but shut down its service in 2018. Akismet's service has been running continuously since 2005.
- AntiSpam was an earlier unofficial Akismet integration for Drupal 6/7 that is no longer maintained. This module is the official Akismet integration, built and maintained by the Akismet team at Automattic.
- Honeypot and CAPTCHA use client-side techniques (hidden fields, challenges) rather than content analysis. They work well as a complement to Akismet, not a replacement, since they don't analyze the actual content of submissions.

Supporting this Module

Akismet is built and maintained by Automattic. The service is free for personal sites and available through paid plans for commercial use. The best way to support continued development is to sign up for an Akismet plan at https://akismet.com/.

Community Documentation

- Akismet developer documentation
- Getting started with Akismet