Spam Score

Spam Score provides local, explainable spam detection for
Drupal forms. It evaluates submissions using configurable rules, calculates
a numeric spam score, and records the reasons that contributed to the result.

Unlike spam services that require form content to be sent to an external
classification API, Spam Score can perform its core analysis entirely within
Drupal. Administrators can start in log-only mode, review real submissions,
tune scoring rules, and enable enforcement when ready.

Spam Score supports Drupal core Contact forms,
native Webform integration, and custom Drupal form
integrations. It is designed to complement protections such as Honeypot,
CAPTCHA, Antibot, rate limiting, and WAF/CDN controls.

Why use Spam Score?

• Explainable decisions:
  See which signals contributed to each score instead of receiving only a
  spam/not-spam result.
• Local processing:
  No external spam-classification API is required, so submitted content can
  remain on your Drupal site.
• Configurable scoring:
  Adjust thresholds, rule weights, domains, keywords, duplicate detection,
  and other signals.
• Safe rollout:
  Start in log-only mode and observe real traffic before enabling blocking.
• Auditability:
  Review scores, triggered rules, submission outcomes, and related activity.
• Native Webform support:
  Add Spam Score as a handler to individual Webforms.
• Extensible:
  Custom modules can provide site-specific form mappings and private scoring
  logic without modifying Spam Score.
• Layered protection:
  Spam Score can complement Honeypot, CAPTCHA, Antibot, rate limiting, and
  infrastructure-level protections.

Features

• Numeric spam scoring with per-rule explanations.
• Configurable thresholds and rule weights.
• Log-only and enforcement modes.
• Drupal core Contact form integration.
• Native Webform handler for per-Webform spam scoring and enforcement.
• Support for custom Drupal form integrations.
• Duplicate and flood detection.
• Content, link, and markup analysis.
• Configurable domain, phrase, allowlist, and blocklist signals.
• Disposable email-domain detection.
• Administrative reports and audit history.
• Optional mail outcome tracking and retry support.
• Drush commands for diagnostics, testing, exports, and maintenance.
• Extension hooks for custom and private site-specific integrations.

Native Webform integration

When the contributed Webform module is installed,
administrators can add a Spam Score handler to individual
Webforms.

The handler evaluates submitted values using the same local scoring engine
used elsewhere in Spam Score. Relevant text, email, URL, and other submitted
values can contribute to the score without requiring a single hard-coded
message field.

Each evaluated Webform submission can be recorded with its numeric score,
verdict, and the individual signals that contributed to the decision.

Log-only mode

In log-only mode, Webform submissions continue through the normal Webform
workflow even when their score would otherwise be considered suspicious.
This allows administrators to observe real traffic and tune scoring rules
before enabling enforcement.

Enforcement mode

In enforcement mode, submissions that reach the configured rejection
threshold can be stopped during validation before the Webform submission is
persisted or later submission handlers are executed.

Webform remains optional. Sites that do not use Webform can continue using
Spam Score with Drupal core Contact forms and custom Drupal integrations.

Use cases

Spam Score is useful when basic bot protection alone is not enough.
Unwanted submissions may come from real browsers, arrive slowly enough to
avoid simple rate limits, or contain text written to resemble legitimate
human messages.

Typical use cases include:

• Contact forms receiving promotional or solicitation spam that passes
  honeypot-style protection.
• Webforms that need an additional content- and behavior-based spam layer.
• Organizations that do not want submitted form content sent to an external
  spam-classification service.
• Administrators who need to understand why a submission was classified as
  suspicious.
• Sites that want to observe scoring before enabling automatic rejection.
• Custom Drupal applications that need organization-specific rules while
  sharing a reusable scoring and reporting framework.

Installation

Install with Composer:

composer require drupal/spam_score

Then enable the module:

drush en spam_score

The module can also be enabled through Drupal's
Extend administration page.

Webform is optional. Install and enable Webform only when the native Webform
handler is needed.

Configuration

After enabling Spam Score, configure it at:

Administration > Configuration > Content authoring > Spam Score

or:

/admin/config/content/spam-score

New installations should normally begin in
log-only mode. This allows Spam Score to calculate and
record scores without rejecting submissions.

Administrators can configure scoring thresholds, rule weights, protected
forms, allowlists and blocklists, duplicate/flood behavior, retention
options, and optional mail tracking.

Webform configuration

For Webform protection, edit the desired Webform and add the
Spam Score handler from the Webform handler configuration.

This allows Spam Score to be enabled selectively for public-facing Webforms
without requiring every Webform on the site to use the same workflow.

Reports

Spam Score reports are available at:

/admin/reports/spam-score

Reports provide visibility into submission scores, verdicts, triggered
scoring signals, and supported mail outcomes.

Reviewing report data while operating in log-only mode is recommended before
enabling stronger enforcement on a production site.

Requirements

• Drupal 10.3 or later, or Drupal 11.
• No external spam-classification API or subscription is required.
• Drupal core Contact is used when protecting Drupal Contact forms.
• Webform 6.3 or later is optional and is required only for the native
  Webform handler.

Privacy and data control

Spam Score can perform its core classification locally, allowing sites to
retain control of submitted content instead of sending it to a remote
classification service.

Administrators should still configure logging and data retention according
to their organization's privacy and retention requirements.

Organization-specific scoring rules can be kept in private configuration or
custom modules instead of being contributed to the public Spam Score
project.

Similar projects

Honeypot

Honeypot primarily detects automated submissions using hidden fields and
timing behavior. Spam Score instead evaluates multiple content and
submission signals and produces an explainable numeric score.

These approaches are complementary and can be used together.

SpamAway

SpamAway focuses on Webform spam protection using submission similarity,
rate-related behavior, and related signals.

Spam Score provides a broader scoring framework where multiple independent
content and behavioral signals contribute to an explainable score. It also
supports Drupal core Contact forms and custom Drupal integrations in
addition to its native Webform handler.

Akismet, CleanTalk, KireiFilter, and hosted spam services

Hosted spam services can provide centralized reputation and classification
intelligence.

Spam Score differs by allowing the core scoring process to operate locally
without requiring submitted form content to be sent to a third-party
classification API.

Extending Spam Score

Spam Score is designed as a reusable scoring framework rather than a closed
set of site-specific rules.

Custom modules can extend Spam Score with application-specific form
mappings, scoring inputs, mail correlation behavior, and private detection
logic while continuing to use the common scoring, reporting, enforcement,
and audit infrastructure.

Testing and quality

Development uses Drupal.org GitLab CI and includes automated checks for
Drupal coding standards, static analysis, spelling, and PHPUnit tests.

Automated coverage includes Unit, Kernel, and Functional tests for scoring,
configuration, persistence, upgrade behavior, administrative access,
Drupal Contact integration, and native Webform submission and enforcement
workflows.

Project status

Spam Score is currently in pre-release development. The project is being
tested and stabilized before the 1.0 API and configuration behavior are
declared stable.

Site builders are encouraged to begin in log-only mode and report issues or
unexpected scoring behavior through the Drupal.org issue queue.

Supporting this module

Bug reports, feature requests, testing, documentation improvements, and
patches are welcome through the Drupal.org project issue queue.