Spam Score

Spam Score provides local, explainable spam detection for Drupal forms.
It evaluates submissions using configurable rules, calculates a numeric
spam score, and records the reasons that contributed to the result.

Unlike spam services that require form content to be sent to an external
API, Spam Score can perform its core analysis entirely within Drupal.
Administrators can start in log-only mode, review real submissions, tune
the scoring rules, and enable enforcement when ready.

Spam Score is designed for sites that need an additional layer of protection
beyond traditional bot defenses such as Honeypot, CAPTCHA, or rate limiting.
It is especially useful for public-facing Contact forms, custom Drupal forms,
and sites using Webform where unwanted submissions may look like legitimate
human messages rather than simple automated bot traffic.

Why use Spam Score?

• Explainable decisions: See which signals contributed to each score instead of receiving only a spam/not-spam result.
• Local processing: No external spam-classification API is required, so submitted content can remain on your Drupal site.
• Configurable scoring: Adjust thresholds, rule weights, domains, keywords, duplicate detection, and other signals.
• Safe rollout: Start in log-only mode before blocking submissions.
• Auditability: Review scores, reasons, submission outcomes, and related activity.
• Extensible: Custom modules can add site-specific form mappings and private scoring logic.
• Works with other protection: Can complement Honeypot, CAPTCHA, Antibot, rate limiting, and WAF/CDN protections.
• Useful against harder-to-detect spam: Adds content- and behavior-based scoring for submissions that may pass basic bot checks.

Features

• Numeric spam scoring with per-rule explanations.
• Configurable thresholds and rule weights.
• Log-only and enforcement modes.
• Drupal core Contact form support.
• Native Webform integration: Add Spam Score as a handler to individual Webforms for local, explainable scoring and optional enforcement without sending submission content to an external classification service.
• Designed for custom Drupal form integrations.
• Suitable for extending to Webform-based workflows through the module's integration hooks.
• Duplicate and flood detection.
• Content, link, and markup analysis.
• Configurable domain and keyword lists.
• Administrative reports and audit history.
• Optional mail outcome tracking and retry support.
• Drush commands for testing, diagnostics, exports, and maintenance.
• Extension hooks for custom Drupal integrations.

Webform use cases

Webform is widely used for public-facing Drupal forms and has an established
ecosystem of spam-protection add-ons, including Honeypot, CAPTCHA, Antibot,
SpamAway, and other specialized tools.

Spam Score is designed to complement those protections by adding an
explainable scoring layer. Instead of relying on only one
signal, a site can evaluate multiple characteristics of a submission and
record why a message appears suspicious.

For sites using Webform, Spam Score can be integrated with custom Webform
workflows through its extension hooks and form-mapping API. This allows
site-specific integrations to score relevant text, email, URL, and other
submission values while keeping private detection rules outside the public
module.

Spam Score provides a built-in native Webform integration.
When Webform is installed, administrators can add the Spam Score handler to
individual Webforms and apply the same local, explainable scoring used by the
rest of the module.

The Webform handler can evaluate submitted text, email, URL, and other field
values, calculate a spam score, record the signals that contributed to the
decision, and apply the configured log-only or enforcement behavior.

Webform remains optional. Sites that do not use Webform can continue using
Spam Score with Drupal core Contact forms and custom Drupal form integrations.

When is Spam Score useful?

Spam Score is particularly useful when basic bot protection is not enough.
For example, some unwanted submissions are created through real browsers,
submitted slowly enough to avoid rate limits, or written to resemble normal
human messages.

In those situations, Spam Score provides another layer of analysis by
combining multiple content and submission signals into a single auditable
score. It can be used alongside existing protections rather than replacing
them.

Post-installation

After enabling the module, configure it at:

Administration > Configuration > Content authoring > Spam Score

or:

/admin/config/content/spam-score

New installations should normally begin in log-only mode.
This allows Spam Score to calculate and record scores without rejecting
submissions.

Reports are available at:

/admin/reports/spam-score

After reviewing real submissions, administrators can adjust thresholds and
rule weights before enabling stronger enforcement.

Requirements

Spam Score does not require an external API, subscription, or hosted
spam-classification service. It uses Drupal core APIs and integrates with
the Drupal core Contact module when Contact forms are protected.

Webform is not required. Sites that use Webform can build
site-specific integrations through Spam Score's extension API. A future native
Webform integration can provide a more direct handler-based workflow.

Similar projects

Honeypot primarily detects automated submissions using hidden
fields and timing behavior. Spam Score instead evaluates multiple submission
and content signals and produces an explainable numeric score. The two modules
can be used together.

SpamAway provides a Webform handler focused on submission
similarity and submission-rate/IP behavior. Spam Score takes a broader scoring
approach in which multiple independent content and behavioral signals can
contribute to an explainable score. Spam Score is also intended as a reusable
framework for Contact forms and custom Drupal form integrations, rather than
being limited to one form-building system.

Akismet, CleanTalk, KireiFilter, and similar hosted services
provide external spam intelligence. Spam Score differs by allowing the core
scoring process to remain entirely on the Drupal site without requiring a
third-party classification API.

Spam Score is intended to provide a reusable local spam-scoring and
auditing framework, rather than a single spam-detection technique.

Supporting this module

Bug reports, feature requests, testing, documentation improvements, and
patches are welcome through the Drupal.org project issue queue.