Mailchimp Honeypot

Introduction

Mailchimp Honeypot Protection adds Honeypot spam protection to
Mailchimp signup forms. It stops bots from filling your
audiences with fake subscribers, without making real visitors solve a CAPTCHA.

It protects signup forms wherever they appear (on their own page, in a block or through the signup field formatter)
and counts the submissions it blocks on each one.

Project Summary

Keep spam signups out of your Mailchimp audiences: add Honeypot's hidden field and time restriction to all or some
Mailchimp signup forms, and see how many bot submissions each one blocks.

Features

• Protect every Mailchimp signup form, including ones created later, or only the forms you pick.
• Choose the protections: Honeypot's hidden field, its time restriction, or both.
• Set a minimum time before Mailchimp signup forms can be submitted, separate from the Honeypot time limit used on the rest of the site. Repeat offenders still get the extra delay Honeypot adds.
• Optionally protect forms for anonymous visitors only, so logged in users never see the protections.
• Counts blocked submissions per signup form, split by reason, with the time of the last one. Counts can be reset from the settings page.
• Optionally logs each blocked submission to the site log, separately from Honeypot's own sitewide logging.
• Never adds protection twice, for example when Honeypot is already set to protect all forms.
• Cache-aware: cached signup blocks are rebuilt as soon as the settings change.
• Removes a signup form's settings and counts when the signup form is deleted, and all its data when the module is uninstalled.

Post-Installation

After installing the module:

1. Grant the Administer Mailchimp Honeypot permission to the roles that should manage the settings.
2. Go to Configuration → Web services → Mailchimp Honeypot settings (/admin/config/mailchimp-honeypot).
3. Tick Protect all Mailchimp signup forms, or pick the signup forms to protect.
4. Choose the protections and, if you like, a minimum time before submitting.
5. If you use the time restriction, make sure the Time limit on the Honeypot settings page is greater than 0.

Additional Requirements

• Drupal 10.3+ or 11
• Honeypot 2.2+
• Mailchimp 3.1+, with the Mailchimp Signup submodule

Similar projects

Honeypot can protect any form by its form ID, but Mailchimp signup forms get a different form ID for each signup and
each place they are shown, so they are hard to target from Honeypot's own settings. This module finds them all, lets
you configure them in one place, and reports what was blocked.

Supporting this Module

Bug reports, feature requests, patches, and documentation improvements are welcome through the Drupal.org issue
queue.

Community Documentation

Documentation is available in the project repository's README.

Upgrading

Run drush updb after updating. The update adds the new settings and grants the new
Administer Mailchimp Honeypot permission to every role that had Administer site
configuration, so existing administrators keep access to the settings page. The minimum time setting now keeps
Honeypot's extra delay for repeat offenders instead of replacing it.

Permissions

• Administer Mailchimp Honeypot (restricted) – choose which signup forms are protected and how, and view and reset blocked submission counts.
• Honeypot's Bypass Honeypot protection permission is respected: users who have it are never shown the protections.

The module is fully compatible with Drupal 11.