Akismet Laravel Package

Getting Started

1. Install the addon: composer require silentz/akismet.
2. Publish whatever config ships with it (php artisan vendor:publish --tag=akismet-config or the provider tag — check vendor/silentz/akismet/src for the exact tag).
3. Get an Akismet key from akismet.com, then set AKISMET_API_KEY (and the site URL Akismet should associate with the key) in .env. The site URL must match the domain registered with Akismet, or every check will fail.
4. Clear config cache (php artisan config:clear) and confirm the key is valid before wiring it into a form.
5. First use case: a standard Statamic contact form. Add the addon's rule/listener to that form's config, submit a test entry, and verify the submission is either accepted or flagged as spam rather than silently dropped.

Where to look first: the package README, config/akismet.php (field mapping and API options), the service provider (what it registers), and the listener/validator that actually calls Akismet. With a package this small, reading src/ end-to-end takes minutes and is more reliable than the docs.

Implementation Patterns

• Form-level protection. The usual pattern is either a validation rule added to the form's validate block or a listener on Statamic's FormSubmitted event. Determine which this version uses before building around it; a listener-based addon won't run if you submit programmatically without firing the event.
• Mark, don't reject. Prefer letting the submission be stored and flagged as spam (so it's reviewable in the control panel) over returning a validation error. Rejecting tells bots they were caught and gives you no audit trail.
• Map your fields explicitly. Akismet wants author name, email, comment/content, permalink, IP, and user agent. Most forms use different field handles, so publish the config (or whatever mapping hook exists) and map name/email/message deliberately. Wrong mappings are the most common cause of poor detection.
• Feedback loop. When you confirm a submission is spam or ham in the CP, call Akismet's submit-spam / submit-ham endpoints. A few minutes of feedback per week noticeably improves accuracy for your specific form traffic.
• Test with Http::fake(). Fake the Akismet endpoint returning true, false, and an error, then assert the submission is stored/flagged accordingly. Add one test for a timeout to confirm your fail-open behaviour.
• Defence in depth. Pair Akismet with a honeypot field and rate limiting. Akismet is a content classifier; it does not stop volumetric attacks.
• Per-environment config. Disable the check in local and testing, and use a separate key/site for staging if you want realistic behaviour there.

Gotchas and Tips

• Synchronous HTTP on submit. The Akismet call happens inline with the form submission. Set a short timeout and wrap the call so a network failure doesn't take the form down — decide explicitly whether to fail open (accept) or fail closed (reject) and document it.
• Key/site mismatch. Akismet validates the key against the calling site. A key registered for example.com used from staging.example.com returns invalid, and depending on the addon that may surface as "not spam" rather than an error. Log the raw response while setting up.
• Config cache. Env changes won't take effect until config:clear. This bites people who add the key after deploying.
• Silent failures. Akismet returns HTTP 200 with a body of true/false; errors and invalid keys can be easy to miss if the addon swallows exceptions. Add temporary logging around the client during rollout.
• PII and GDPR. You are sending names, emails, IPs, and message bodies to a third party. Mention it in your privacy policy and get sign-off if you're handling EU personal data.
• Event coverage. If your app creates submissions outside the normal form request lifecycle (imports, API endpoints, custom controllers), the addon likely won't run. Call the client directly in those paths.
• Adoption risk. Four stars and zero dependents means very few people are exercising edge cases. Pin the version in composer.json, skim the source before upgrading Statamic major versions, and be prepared to fork. The listed last-release date is unusual — verify it against Packagist before assuming active maintenance.
• Extension points. Because it's a small package, the pragmatic extension strategy is to bind your own Akismet client or decorate the addon's listener in a service provider rather than patching vendor code. Keep any overrides in app/ so composer update stays safe.