GiveWP is the most popular fundraising and donation tool on WordPress, powering over $500 million in donations. It integrates with Akismet to ensure that spammy or potentially fraudulent submissions get filtered out. Recently, some Give users saw an unusually high level of false positives on their donation forms: legitimate donation submissions that were being marked as spam.
We investigated and found that the donation forms were being sent to Akismet for checking after each step in the donation process: once after choosing an amount, again after the user entered their name, again after they entered an optional message, etc. To Akismet, this looks like sudden repeated submissions from the same user, all with similar content (better known as spam).
Akismet supports rechecking content, but only if the integration includes the recheck_reason parameter. If that parameter is present, Akismet knows not to classify the repeated duplicate (or nearly duplicate) checks as part of a spam attack; however, if recheck_reason is omitted, this kind of consecutive similar content looks very similar to spam, and Akismet blocks it.
We reported the root issue to Liquid Web, and they quickly addressed it and released a fix in version 4.16.0. This kind of collaboration is what makes Open Source great!
We’re planning on bringing automatic integration review to more clients and platforms, so stay tuned for more tips and insights.
