strangerstudios / pmpro-akismet Goto Github PK

The Akismet API is fast, but every API call we add to the pmpro_registration_checks hook adds time to checkout.

If we just move the whole check to the frontend via JS, then spammers can figure out ways to disable that check. So we need a kind of hybrid solution.

Something like this might work...

1. When an email is entered into the form at checkout (tab away), kick off an ajax call to check the email.
2. The callback checks the email via the Akismet API then generates a random string and saves it into session.
3. The random string is sent back to the frontend and embedded as a hidden var in the form.
4. When the form is submitted, it will check if the random string matches. If not, then it will check the email via the API in php as a fall back.

A neat logger for capturing some information when spam is detected will help developer's see if the plugin's working as intended or marking false positives.

Information to log:

• Checkout information (except password and any card information)
• IP Address
• Akismet response/status (if their API gives more information)

The logger would need to be a turn on/turn off via a constant as it can quickly fill up disk usage on servers.