Settings

Open AntiSpam -> Settings in the Craft Control Panel. Settings are split across seven tabs.

info

The master Enable Anti-Spam Protection switch on the General tab must be on for any other check to run. When it's off, all submissions pass through untouched and no logging happens.

General

Setting	Effect
Enable Anti-Spam Protection	Master switch. All checks below are skipped when this is off.
Enable Logging	Logs every spam event to the database. Required for the auto-ban counter, the weekly report, and the analytics dashboard.
Enable IP Blocking	Rejects submissions from IPs on the Banned IPs list.
Auto IP Blocking	Automatically bans an IP once it triggers a configured number of spam events within a time window (see Logs & Reports).

Content Rules

Honeypot

• Enable Honeypot — rejects a submission if a hidden trap field (invisible to real visitors) comes back filled in.
• Honeypot Field Name — the name attribute of that hidden input in your form template. You add the field yourself; AntiSpam just checks it.
• Use Advanced Honeypot (CSS + JS) — when on, AntiSpam injects CSS/JS on the front end to visually hide the field and resist bots that try to detect and skip honeypots.

Submission Timing

• Enable Submission Time Check — rejects forms completed faster than the configured minimum, since real visitors rarely fill out a form in under a couple of seconds.
• Minimum Submission Time (seconds) — default 3.
• Enable Submission Fingerprint — injects a small script that records a timestamp and whether any mouse/touch movement occurred before submit; submissions with zero movement are flagged. Independent of the honeypot and timing checks.

Email Domain Blacklist

• Enable Email Domain Blacklist — rejects submissions whose email address uses a known disposable/throwaway provider (~950 domains built in).
• Email Field Name — the name attribute of the email input in your form.
• Additional Blocked Domains — one domain per line, appended to the built-in list.

Content Scoring

• Enable Content Scoring — scores message text on link density, spam keywords, all-caps ratio, and a language/country mismatch; rejects submissions at or above the threshold.
• Score Threshold — default 10.
• Max Links Allowed — links up to this count are free; each extra http(s) link adds +3 to the score. Default 2.
• Spam Keywords — one keyword per line; each match adds +2. Ships with common spam terms (casino, viagra, click here, buy now, free money, winner, prize, loan, crypto).
• Content Field Names — one form field name per line; only these fields are scored (defaults to message, body, content).

Geo

• Enable Country Validation — rejects submissions from IPs outside the Allowed Countries list. Defaults to SK, CZ, HU, DE, AT.
• GeoLite2 DB Path — absolute path to a local GeoLite2-Country.mmdb file (requires geoip2/geoip2 via Composer). Leave blank to fall back to the free, rate-limited ip-api.com lookup service.
• Phone validation fields (on this tab, driven by the same country lookup) reject a submitted phone number that doesn't match the expected pattern for the resolved country. Configure the phone field's name attribute so AntiSpam knows which form field to check.

tip

Country validation and phone validation both depend on the same IP→country lookup. If you enable phone validation without a GeoLite2 database configured, expect occasional lookup failures/rate limits from the ip-api.com fallback under load — install the local database for anything beyond light traffic.

Rate Limits

• Enable Rate Limiting — blocks an IP once it exceeds a maximum number of submissions within a time window.
• Max Attempts — default 5.
• Time Window (seconds) — default 300 (5 minutes).

Integrations

All checks on this tab are Premium and require an active AntiSpam license.

Integration	Fields	Notes
Cloudflare Turnstile	Site Key, Secret Key	Standard Turnstile widget verification.
hCaptcha	Site Key, Secret Key	Standard hCaptcha widget verification.
Akismet	API Key, Site URL	Site URL defaults to the primary site URL if left blank.
CleanTalk	API Key
OOPSpam	API Key
DNSBL Lookup	Provider hostnames (editable table)	Checks the sender IP against DNS-based blocklists. Defaults to zen.spamhaus.org and b.barracudacentral.org; add or remove providers as rows.
Custom Rulesets	Regex pattern, field name (blank = all fields), score (editable table)	Each matching rule adds its score to a running total; a submission is rejected once the ruleset score is greater than 0. Pattern must be a valid PHP regex, e.g. /casino/i.

All secret/API-key fields support environment variable references (the $VAR_NAME suggestion in the field) — use this instead of pasting live credentials directly into project config.

Notifications

Requires an active AntiSpam license.

• Enable Spam Wave Notifications — sends an alert when the number of spam events in the last hour exceeds a threshold.
• Spam Wave Threshold — default 10.
• Webhook URL — POST target for a generic webhook or a Slack incoming webhook.
• Format as Slack Message — sends Slack's {text: "…"} payload shape instead of a generic JSON body.
• Telegram — bot token and chat ID fields (below the webhook section) send the same alert to a Telegram chat.

Logs & Reports

• Enable Logging — same setting as on the General tab; logs every spam event.
• Send Weekly Spam Report — emails a weekly summary of spam events.
• Weekly Report Email Addresses — comma-separated recipient list.
• Enable Analytics Dashboard (Premium) — shows spam trend charts in the control panel.

Auto IP blocking (General tab) uses the log to count recent events per IP within Auto-Ban Window (minutes) and bans the IP once Auto-Ban Threshold events occur — both configured alongside logging. Defaults: window 60 minutes, threshold 3 events.

Worked examples

Block signups from disposable email addresses only

1. Content Rules → enable Email Domain Blacklist.
2. Set Email Field Name to match your form's email input (default email).
3. Leave every other check off if you want the lightest possible setup.

Rate-limit one form to 5 submissions per 5 minutes per IP, with auto-ban after repeated abuse

1. Rate Limits → enable Rate Limiting, Max Attempts 5, Time Window 300.
2. General → enable Enable Logging and Auto IP Blocking.
3. Logs & Reports → set an Auto-Ban Window/Threshold that matches your tolerance (default 3 events in 60 minutes).

Restrict a contact form to a store's serving countries

1. Geo → enable Country Validation, set Allowed Countries to the markets you actually serve.
2. For higher-traffic sites, configure the GeoLite2 DB Path to avoid depending on the free lookup fallback.

Get alerted the moment a spam wave starts (Premium)

1. Confirm the AntiSpam license is active.
2. Notifications → enable Spam Wave Notifications, set a Spam Wave Threshold, and add a Slack webhook URL (with Format as Slack Message on) or Telegram bot token/chat ID.

Troubleshooting

• Nothing is being blocked at all — check that the master Enable Anti-Spam Protection switch on General is on, and that craftcms/contact-form is installed and active; AntiSpam silently no-ops otherwise.
• A real customer got blocked — check AntiSpam → Spam Logs for the rejection reason, then loosen the specific check (e.g. widen the allowed-countries list, lower the content score sensitivity, or increase the submission-time minimum tolerance) rather than disabling logging/blocking outright.
• Premium fields don't seem to do anything — Turnstile, hCaptcha, Akismet, CleanTalk, OOPSpam, DNSBL, custom rulesets, and spam-wave notifications all require an active AntiSpam license; unlicensed installs get the free checks only.