Home

PHP Form Spam Checker

A layered, dependency-free anti-spam pipeline and HTTP firewall for any PHP form: local heuristics first, then behavioural signals, IP reputation, DNS blocklists, mail-domain authentication and a Bayesian classifier, with an optional WAF over the whole HTTP request. No captcha, no runtime Composer dependencies, and every verdict carries evidence — which checks ran, with which scores, and why (README.md, opening paragraph).

The current release is 2.1.2 (2026-11-04, CHANGELOG.md, section [2.1.2]): it adds the Cyrillic name requirement on top of the 2.1 line. Version 2.1 (2026-11-03, section [2.1.0]) keeps the 2.0 architecture and adds the firewall bridge and deployment hardening:

• Cyrillic requirement for names (language.require_cyrillic, 2.1.2) — an opt-in rule, disabled by default: configured name fields must contain a Cyrillic letter, a Latin-only name scores missing_score (60 where it should block), and e-mail, company and free-text fields are never checked.
• Fail2Ban bridge — every hard-spam verdict and every WAF block appends one timestamped PHPFSC BAN ip=… line to a per-site log, ready for a Fail2Ban filter and jail.
• Application auto-ban — the autoban check rejects an IP before any other check after N hard events inside a window.
• AbuseIPDB threshold = 100 deployment guidance: only IPs whose confidence score is exactly 100 are treated as spam by the reference deployments (the library default stays 90).

Start here

Step	Page	Why
1	Installation	requirements, Composer or a plain copy, verification
2	Quick Start	one protected form, the CLI probe and the HTTP endpoint
3	Configuration	defaults, per-form overrides, storage and logging

Protection

Topic	Page	What it covers
Checks	Checks	the 20 pipeline checks, scores, statuses, false positives, custom checks
HTTP firewall	WAF	the 9 request rules, monitor-to-block rollout, deployment, CLI bridge
Firewall bans	Fail2Ban and Auto-Ban	PHPFSC BAN lines, the jail, the application-level ban

Operations

Task	Page	What it covers
Deploy next to a site	Integration	library, shared module, drop-in WAF, CLI bridges, HTTP endpoint
Upgrade a 1.x install	Migration from 1.x	kept contracts, moved classes, rollback, checklist

What this wiki is

A manual for the people who install and run the library. It is organised by task, not by source file, and it does not repeat the README. Numbers are quoted together with the repository document and section they come from; when a page and the source disagree, the source wins and the mismatch is worth a bug report.

The upstream documents remain authoritative:

Document	Contents
README.md	overview, feature table, default scores
AGENTS.md	non-interactive operational contract
docs/CONFIG.md	full configuration tree
docs/CHECKS.md	check semantics and false positives
docs/WAF.md	threat model, rules matrix, rollout
docs/INTEGRATION.md	wiring guide (also available in Russian)
docs/MIGRATION-1-to-2.md	1.x compatibility and rollback
SECURITY.md	security model, network egress, secrets
CHANGELOG.md	release notes

Project links

• Repository
• Releases
• Issues
• Security advisories
• License: MIT (LICENSE, composer.json)

Next

Begin with Installation, or go straight to Quick Start if the library is already present.