Akismet Anti-Spam

Release Date - 1 December 2022

• Improved compatibility with themes that hide or show UI elements based on mouse movements.
• Increased security of API keys by sending them in request bodies instead of subdomains.

Release Date - 28 September 2022

• Added an empty state for the Statistics section on the admin page.
• Fixed a bug that broke some admin page links when Jetpack plugins are active.
• Marked some event listeners as passive to improve performance in newer browsers.
• Disabled interaction observation on forms that post to other domains.

Release Date - 26 July 2022

• Added a new feature to catch spammers by observing how they interact with the page.

Release Date - 11 July 2022

• Fixed a bug that added unnecessary comment history entries after comment rechecks.
• Added a notice that displays when WP-Cron is disabled and might be affecting comment rechecks.

Release Date - 20 May 2022

• Improved translator instructions for comment history.
• Bumped the "Tested up to" tag to WP 6.0.

Release Date - 25 April 2022

• Improved compatibility with Fluent Forms
• Fixed missing translation domains
• Updated stats URL.
• Improved accessibility of elements on the config page.

Release Date - 24 January 2022

• Improved compatibility with Formidable Forms
• Fixed a bug that could cause issues when multiple contact forms appear on one page.
• Updated delete_comment and deleted_comment actions to pass two arguments to match WordPress core since 4.9.0.
• Add a filter that allows comment types to be excluded when counting users' approved comments.

Release Date - 1 October 2021

• Fixed a bug causing AMP validation to fail on certain pages with forms.

Release Date - 30 September 2021

• Added links to additional information on API usage notifications.
• Reduced the number of network requests required for a comment page when running Akismet.
• Improved compatibility with the most popular contact form plugins.
• Improved API usage buttons for clarity on what upgrade is needed.

Release Date - 3 September 2021

• Fixed "Use of undefined constant" notice.
• Improved styling of alert notices.

Release Date - 23 August 2021

• Added support for Akismet API usage notifications on Akismet settings and edit-comments admin pages.
• Added support for the deleted_comment action when bulk-deleting comments from Spam.

Release Date - 6 July 2021

• Simplified the code around checking comments in REST API and XML-RPC requests.
• Updated Plus plan terminology in notices to match current subscription names.
• Added rel="noopener" to the widget link to avoid warnings in Google Lighthouse.
• Set the Akismet JavaScript as deferred instead of async to improve responsiveness.
• Improved the preloading of screenshot popups on the edit comments admin page.

Release Date - 2 March 2021

• Improved handling of pingbacks in XML-RPC multicalls

Release Date - 6 January 2021

• Fixed missing fields in submit-spam and submit-ham calls that could lead to reduced accuracy.
• Fixed usage of deprecated jQuery function.

Release Date - 22 October 2020

• Show the "Set up your Akismet account" banner on the comments admin screen, where it's relevant to mention if Akismet hasn't been configured.
• Don't use wp_blacklist_check when the new wp_check_comment_disallowed_list function is available.

Release Date - 4 June 2020

• Disable "Check for Spam" button until the page is loaded to avoid errors with clicking through to queue recheck endpoint directly.
• Add filter "akismet_enable_mshots" to allow disabling screenshot popups on the edit comments admin page.

Release Date - 29 April 2020

• Based on user feedback, we have dropped the in-admin notice explaining the availability of the "privacy notice" option in the AKismet settings screen. The option itself is available, but after displaying the notice for the last 2 years, it is now considered a known fact.
• Updated the "Requires at least" to WP 4.6, based on recommendations from https://wp-info.org/tools/checkplugini18n.php?slug=akismet
• Moved older changelog entries to a separate file to keep the size of this readme reasonable, also based on recommendations from https://wp-info.org/tools/checkplugini18n.php?slug=akismet

Release Date - 17 March 2020

• Only redirect to the Akismet setup screen upon plugin activation if the plugin was activated manually from within the plugin-related screens, to help users with non-standard install workflows, like WP-CLI.
• Update the layout of the initial setup screen to be more readable on small screens.
• If no API key has been entered, don't run code that expects an API key.
• Improve the readability of the comment history entries.
• Don't modify the comment form HTML if no API key has been set.

Release Date - 31 October 2019

• Prevented an attacker from being able to cause a user to unknowingly recheck their Pending comments for spam.
• Improved compatibility with Jetpack 7.7+.
• Updated the plugin activation page to use consistent language and markup.
• Redirecting users to the Akismet connnection/settings screen upon plugin activation, in an effort to make it easier for people to get setup.

Release Date - 14 May 2019

• Fixed a conflict between the Akismet setup banner and other plugin notices.
• Reduced the number of API requests made by the plugin when attempting to verify the API key.
• Include additional data in the pingback pre-check API request to help make the stats more accurate.
• Fixed a bug that was enabling the "Check for Spam" button when no comments were eligible to be checked.
• Improved Akismet's AMP compatibility.

Release Date - 31 January 2019

• Fixed the "Setup Akismet" notice so it resizes responsively.
• Only highlight the "Save Changes" button in the Akismet config when changes have been made.
• The count of comments in your spam queue shown on the dashboard show now always be up-to-date.

Release Date - 12 November 2018

• Added a WP-CLI method for retrieving stats.
• Hooked into the new "Personal Data Eraser" functionality from WordPress 4.9.6.
• Added functionality to clear outdated alerts from Akismet.com.

Release Date - 19 June 2018

• Improved the grammar and consistency of the in-admin privacy related notes (notice and config).
• Revised in-admin explanation of the comment form privacy notice to make its usage clearer.
• Added rel="nofollow noopener" to the comment form privacy notice to improve SEO and security.

Release Date - 28 May 2018

• Based on user feedback, the link on "Learn how your comment data is processed." in the optional privacy notice now has a target of _blank and opens in a new tab/window.
• Updated the in-admin privacy notice to use the term "comment" instead of "contact" in "Akismet can display a notice to your users under your comment forms."
• Only show in-admin privacy notice if Akismet has an API Key configured

Release Date - 26 May 2018

• Moved away from using empty( get_option() ) to instantiating a variable to be compatible with older versions of PHP (5.3, 5.4, etc).

Release Date - 26 May 2018

• Corrected version number after tagging. Sorry...

Release Date - 26 May 2018

• Added a hook to provide Akismet-specific privacy information for a site's privacy policy.
• Added tools to control the display of a privacy related notice under comment forms.
• Fixed HTML in activation failure message to close META and HEAD tag properly.
• Fixed a bug that would sometimes prevent Akismet from being correctly auto-configured.

Release Date - 19 February 2018

• Added a scheduled task to remove entries in wp_commentmeta that no longer have corresponding comments in wp_comments.
• Added a new akismet_batch_delete_count action to the batch delete methods for people who'd like to keep track of the numbers of records being processed by those methods.

Release Date - 18 December 2017

• Fixed a bug that could cause Akismet to recheck a comment that has already been manually approved or marked as spam.
• Fixed a bug that could cause Akismet to claim that some comments are still waiting to be checked when no comments are waiting to be checked.

Release Date - 6 November 2017

• Fixed a bug that could prevent some users from connecting Akismet via their Jetpack connection.
• Ensured that any pending Akismet-related events are unscheduled if the plugin is deactivated.
• Allow some JavaScript to be run asynchronously to avoid affecting page render speeds.

Release Date - 19 September 2017

• Added REST API endpoints for configuring Akismet and retrieving stats.
• Increased the minimum supported WordPress version to 4.0.
• Added compatibility with comments submitted via the REST API.
• Improved the progress indicator on the "Check for Spam" button.

• Disabled Akismet's debug log output by default unless AKISMET_DEBUG is defined.
• URL previews now begin preloading when the mouse moves near them in the comments section of wp-admin.
• When a comment is caught by the Comment Blacklist, Akismet will always allow it to stay in the trash even if it is spam as well.
• Fixed a bug that was preventing an error from being shown when a site can't reach Akismet's servers.

Release Date - 13 July 2017

• Reduced amount of bandwidth used by the URL Preview feature.
• Improved the admin UI when the API key is manually pre-defined for the site.
• Removed a workaround for WordPress installations older than 3.3 that will improve Akismet's compatibility with other plugins.
• The number of spam blocked that is displayed on the WordPress dashboard will now be more accurate and updated more frequently.
• Fixed a bug in the Akismet widget that could cause PHP warnings.

Release Date - 10 May 2017

• Fixed a bug causing JavaScript errors in some browsers.

Release Date - 2 May 2017

• Improve performance by only requesting the akismet_comment_nonce option when absolutely necessary.
• Fixed two bugs that could cause PHP warnings.
• Fixed a bug that was preventing the "Remove author URL" feature from working after a comment was edited using "Quick Edit."
• Fixed a bug that was preventing the URL preview feature from working after a comment was edited using "Quick Edit."

Release Date - 23 February 2017

• Updated the Akismet admin pages with a new clean design.
• Fixed bugs preventing the akismet_add_comment_nonce and akismet_update_alert wrapper functions from working properly.
• Fixed bug preventing the loading indicator from appearing when re-checking all comments for spam.
• Added a progress indicator to the "Check for Spam" button.
• Added a success message after manually rechecking the Pending queue for spam.

Release Date - 6 September 2016

• Added a WP-CLI module. You can now check comments and recheck the moderation queue from the command line.
• Stopped using the deprecated jQuery function .live().
• Fixed a bug in remove_comment_author_url() and add_comment_author_url() that could generate PHP notices.
• Fixed a bug that could cause an infinite loop for sites with very very very large comment IDs.
• Fixed a bug that could cause the Akismet widget title to be blank.

Release Date - 12 May 2016

• Fixed a bug that could cause the "Check for Spam" button to skip some comments.
• Fixed a bug that could prevent some spam submissions from being sent to Akismet.
• Updated all links to use https:// when possible.
• Disabled Akismet debug logging unless WP_DEBUG and WP_DEBUG_LOG are both enabled.

Release Date - 1 April 2016

• Fixed a bug that could cause comments caught as spam to be placed in the Pending queue.
• Fixed a bug that could have resulted in comments that were caught by the core WordPress comment blacklist not to have a corresponding History entry.
• Fixed a bug that could have caused avoidable PHP warnings in the error log.

Release Date - 28 March 2016

• Add compatibility with Jetpack so that Jetpack can automatically configure Akismet settings when appropriate.
• Fixed a bug preventing some comment data from being sent to Akismet.

Release Date - 4 March 2016

• Fixed a bug preventing Akismet from being used with some plugins that rewrite admin URLs.
• Reduced the amount of bandwidth used on Akismet API calls
• Reduced the amount of space Akismet uses in the database
• Fixed a bug that could cause comments caught as spam to be placed in the Pending queue.

Release Date - 4 January 2016

• Added documentation for the 'akismet_comment_nonce' filter.
• The post-install activation button is now accessible to screen readers and keyboard-only users.
• Fixed a bug that was preventing the "Remove author URL" feature from working in WordPress 4.4

Release Date - 14 December 2015

• Improve the notices shown after activating Akismet.
• Update some strings to allow for the proper plural forms in all languages.

• Closes a potential XSS vulnerability.

• Closes a potential XSS vulnerability.

Release Date - 13 October 2015

• Closes a potential XSS vulnerability.

Release Date - 13 October 2015

• Closes a potential XSS vulnerability.

Release Date - 24 September 2015

• Fixed a bug that was preventing some users from automatically connecting using Jetpack if they didn't have a current Akismet subscription.
• Fixed a bug that could cause comments caught as spam to be placed in the Pending queue.
• Error messages and instructions have been simplified to be more understandable.
• Link previews are enabled for all links inside comments, not just the author's website link.

Release Date - 6 July 2015

• Notify users when their account status changes after previously being successfully set up. This should help any users who are seeing blank Akismet settings screens.

Release Date - 7 June 2015

• Reduced the amount of space Akismet uses in the commentmeta table.
• Fixed a bug where some comments with quotes in the author name weren't getting history entries
• Pre-emptive security improvements to ensure that the Akismet plugin can't be used by attackers to compromise a WordPress installation.
• Better UI for the key entry field: allow whitespace to be included at the beginning or end of the key and strip it out automatically when the form is submitted.
• When deactivating the plugin, notify the Akismet API so the site can be marked as inactive.
• Clearer error messages.

Release Date - 17th March, 2015

• Improvements to the "Remove comment author URL" JavaScript
• Include the pingback pre-check from the 2.6 branch.

Release Date - 11th March, 2015

• Use HTTPS by default for all requests to Akismet.
• Fix for a situation where Akismet might strip HTML from a comment.

Release Date - 11th December, 2014

• Fix to make .htaccess compatible with Apache 2.4.
• Fix to allow removal of https author URLs.
• Fix to avoid stripping part of the author URL when removing and re-adding.
• Removed the "Check for Spam" button from the "Trash" and "Approved" queues, where it would have no effect.
• Allow automatic API key configuration when Jetpack is installed and connected to a WordPress.com account

Release Date - 3rd November, 2014

• Fix for sending the wrong data to delete_comment action that could have prevented old spam comments from being deleted.
• Added a filter to disable logging of Akismet debugging information.
• Added a filter for the maximum comment age when deleting old spam comments.
• Added a filter for the number per batch when deleting old spam comments.
• Removed the "Check for Spam" button from the Spam folder.

• Performance improvements.
• Fixed a bug that could truncate the comment data being sent to Akismet for checking.

• Removed dependency on PHP's fsockopen function
• Fix spam/ham reports to work when reported outside of the WP dashboard, e.g., from Notifications or the WP app
• Remove jQuery dependency for comment form JavaScript
• Remove unnecessary data from some Akismet comment meta
• Suspended keys will now result in all comments being put in moderation, not spam.

• Move Akismet to Settings menu
• Drop Akismet Stats menu
• Add stats snapshot to Akismet settings
• Add Akismet subscription details and status to Akismet settings
• Add contextual help for each page
• Improve Akismet setup to use Jetpack to automate plugin setup
• Fix Update Check for Spam to use ajax to avoid page timing out
• Fix Akismet settings page to be responsive
• Drop legacy code
• Tidy up CSS and Javascript
• Replace the old discard setting with a new "discard pervasive spam" feature.

• Add ajax paging to the check for spam button to handle large volumes of comments
• Optimize javascript and add localization support
• Fix bug in link to spam comments from right now dashboard widget
• Fix bug with deleting old comments to avoid timeouts dealing with large volumes of comments
• Include X-Pingback-Forwarded-For header in outbound WordPress pingback verifications
• Add pre-check for pingbacks, to stop spam before an outbound verification request is made

• Update 'Already have a key' link to redirect page rather than depend on javascript
• Fix some non-translatable strings to be translatable
• Update Activation banner in plugins page to redirect user to Akismet config page

• Simplify the activation process for new users
• Remove the reporter_ip parameter
• Minor preventative security improvements

• FireFox Stats iframe preview bug
• Fix mshots preview when using https
• Add .htaccess to block direct access to files
• Prevent some PHP notices
• Fix Check For Spam return location when referrer is empty
• Fix Settings links for network admins
• Fix prepare() warnings in WP 3.5

• Security fix for wp_redirect() calls (thanks xknown)

• Prevent retry scheduling problems on sites where wp_cron is misbehaving
• Preload mshot previews
• Modernize the widget code
• Fix a bug where comments were not held for moderation during an error condition
• Improve the UX and display when comments are temporarily held due to an error
• Make the Check For Spam button force a retry when comments are held due to an error
• Handle errors caused by an invalid key
• Don't retry comments that are too old
• Improve error messages when verifying an API key

• Add nonce check for comment author URL remove action
• Fix the settings link

• Limit Akismet CSS and Javascript loading in wp-admin to just the pages that need it
• Added author URL quick removal functionality
• Added mShot preview on Author URL hover
• Added empty index.php to prevent directory listing
• Move wp-admin menu items under Jetpack, if it is installed
• Purge old Akismet comment meta data, default of 15 days

• Specify the license is GPL v2 or later
• Fix a bug that could result in orphaned commentmeta entries
• Include hotfix for WordPress 3.0.5 filter issue

• Properly format the comment count for author counts
• Look for super admins on multisite installs when looking up user roles
• Increase the HTTP request timeout
• Removed padding for author approved count
• Fix typo in function name
• Set Akismet stats iframe height to fixed 2500px. Better to have one tall scroll bar than two side by side.

• Fix a bug that caused the "Auto delete" option to fail to discard comments correctly
• Remove the comment nonce form field from the 'Akismet Configuration' page in favor of using a filter, akismet_comment_nonce
• Fixed padding bug in "author" column of posts screen
• Added margin-top to "cleared by ..." badges on dashboard
• Fix possible error when calling akismet_cron_recheck()
• Fix more PHP warnings
• Clean up XHTML warnings for comment nonce
• Fix for possible condition where scheduled comment re-checks could get stuck
• Clean up the comment meta details after deleting a comment
• Only show the status badge if the comment status has been changed by someone/something other than Akismet
• Show a 'History' link in the row-actions
• Translation fixes
• Reduced font-size on author name
• Moved "flagged by..." notification to top right corner of comment container and removed heavy styling
• Hid "flagged by..." notification while on dashboard

• Track comment actions under 'Akismet Status' on the edit comment screen
• Fix a few remaining deprecated function calls ( props Mike Glendinning )
• Use HTTPS for the stats IFRAME when wp-admin is using HTTPS
• Use the WordPress HTTP class if available
• Move the admin UI code to a separate file, only loaded when needed
• Add cron retry feature, to replace the old connectivity check
• Display Akismet status badge beside each comment
• Record history for each comment, and display it on the edit page
• Record the complete comment as originally submitted in comment_meta, to use when reporting spam and ham
• Highlight links in comment content
• New option, "Show the number of comments you've approved beside each comment author."
• New option, "Use a nonce on the comment form."

• Spell out that the license is GPLv2
• Fix PHP warnings
• Fix WordPress deprecated function calls
• Fire the delete_comment action when deleting comments
• Move code specific for older WP versions to legacy.php
• General code clean up

• Eliminate a potential conflict with some plugins that may cause spurious reports

• Fix bug in initial comment check for ipv6 addresses
• Report comments as ham when they are moved from spam to moderation
• Report comments as ham when clicking undo after spam
• Use transition_comment_status action when available instead of older actions for spam/ham submissions
• Better diagnostic messages when PHP network functions are unavailable
• Better handling of comments by logged-in users

• Add a new AKISMET_VERSION constant
• Reduce the possibility of over-counting spam when another spam filter plugin is in use
• Disable the connectivity check when the API key is hard-coded for WPMU

• Fix a global warning introduced in 2.2.5
• Add changelog and additional readme.txt tags
• Fix an array conversion warning in some versions of PHP
• Support a new WPCOM_API_KEY constant for easier use with WordPress MU