SpamAnvil – AI Anti-Spam & Comment Spam Protection

1.20.1

• Fix: with a slow first model, the fallback model was never tried (introduced in 1.20.0). The time limit gave the first model in the list all the time the run had left. When that model hung, it used up the whole budget, no time remained for the next model, and the next run started again from the first — so a healthy fallback could go unused indefinitely while the comment waited. Each call now leaves at least 8 seconds for every model still behind it in the list, so a hanging first model is cut off in time for the fallback to answer in the same run.
• Fix: the automatic search for a replacement free model (used when a configured model has disappeared) listed the provider’s models with a fixed 30-second timeout, outside the run’s time limit. It now gets only the time that is left, minus what the classification call after it needs.

1.20.0

• Fix: the background job could run far past its time limit. It allows itself 50 seconds per run, but only checked the clock after finishing a whole comment — and a single comment can go through several models, each allowed 60 seconds to answer. On a slow day one run could take minutes, pile up against the next one, or be killed by the host halfway through. Every model call is now limited to the time the run has left, and a call is not started at all when fewer than 8 seconds remain: the comment goes back to the queue untouched and is picked up on the next run. If some models were asked and none answered in time, it counts as a normal failed attempt with the usual backoff, so a model that always hangs cannot keep a comment cycling forever.
• Fix: behind a proxy or CDN, repeat offenders were counted by the proxy’s address. The block check at submission uses the visitor IP from the header you chose on the IP tab (1.10.0), but the repeat-offender count taken after a verdict — usually in the background job — read the address WordPress stored, which behind a proxy is the proxy’s. SpamAnvil now remembers the visitor IP it resolved when the comment arrived and uses that same identity at every step. Sites not behind a proxy are unaffected and store nothing extra.
• Fix: log and statistics retention drifted by the site’s time zone. Entries are written in the site’s local time, but the cleanup compared them against UTC, so on a site at UTC−3 logs were removed 3 hours early (up to 14 hours in other zones). The cutoffs, and the date ranges of the Statistics tab, now use the site’s time zone.
• Fix: the verdict cache did not notice a change of endpoint for the “Generic OpenAI-compatible” provider. Pointing it at another server with the same model name and key kept serving the old server’s verdicts. The endpoint is now part of the provider fingerprint.
• New: a warning under the Generic provider’s API URL when it uses plain http:// to a server on the internet: the API key and every comment, with the commenter’s name and email, would travel unencrypted. Local and private-network addresses (a model on the same machine or LAN) are not flagged.
• Fix: the text SpamAnvil suggests for your privacy policy said IP addresses are stored “only” as hashes. A partly masked form is also kept for the IP tab, and since this release the visitor IP resolved behind a proxy is kept with the comment. The text now says both.
• Clarification of 1.19.1: a moderator’s decision is checked against the database right before a verdict is applied, so a change made while the AI was answering is respected. The check and the write are still two steps, so a moderation landing in the few milliseconds between them can be overwritten; the 1.19.1 notice said “always”, which overstated it.
• Development: the test suite now also runs against WordPress 5.8 on PHP 7.4 — the oldest versions the plugin declares support for — not only the latest WordPress.

1.19.1

• Fix: 1.19.0’s second check before applying a verdict did not work on most sites. It re-read the comment’s status through WordPress’ in-request cache, which the background job had filled when it loaded the comment — so a moderator acting in another browser tab while the model was answering was invisible to it, and the verdict overwrote their decision anyway. The status (and the moderation mark below) is now read straight from the database. The 1.19.0 test changed the comment inside the same request, where the cache is cleared, so it passed without proving anything; the new test writes the database the way a separate request does, and fails against the 1.19.0 code.
• Fix: sending a comment back to “pending” did not count as a moderator’s decision. A comment the AI marked as spam, returned to pending by a moderator, could be picked up again by the automatic scan of pending comments and get the same verdict from the cache; a comment a moderator unapproved could be approved automatically. Now every status change a person (or another plugin) makes — approve, pending, spam, trash — is recorded on the comment, evicts its cached verdict and closes its queue entry, and the automatic paths leave that comment alone. The manual “Scan pending” button is how you ask for a fresh analysis. SpamAnvil’s own verdicts, honeypot, time trap and heuristic blocks are not recorded as moderation.
• Fix: the verdict cache ignored which provider and model answered, so switching to another model kept serving the old model’s verdicts. The provider configuration is now part of the cache key.
• New: the “Privacy Notice” option now does what it says. The checkbox (on by default) was saved but nothing ever displayed it. When SpamAnvil is on and a provider is configured, commenters now see one line above the submit button saying their comment, name, email and website are sent to an external AI service to filter spam. Moderators, whose comments are never analyzed, do not see it. SpamAnvil also suggests matching text for your privacy policy under Settings → Privacy. Turn the option off on the General tab if your privacy policy already covers it.
• Fix: uninstalling with “Delete data” on left behind the cached verdicts and per-comment bookkeeping; they are now removed. The daily email digest is now unscheduled on uninstall, and re-scheduled if its cron event goes missing.

1.19.0

• Fix: the 1.16.0 prompt fix never reached sites that simply clicked “Update”. WordPress does not run a plugin’s activation code on update, so SpamAnvil re-runs its migrations when it notices a new version — but it only compared the database schema version, and 1.16.0 changed the default prompt without changing the schema. Sites that updated from 1.15.x or earlier without deactivating and reactivating stayed on the old prompt, the one that marked comments in another language, and short polite ones, as spam. Migrations now run whenever the plugin version changes, so this update applies the 1.16.0 prompt at last. As before, only unmodified default prompts are replaced; customized prompts are left alone. The 1.16.0 upgrade notice said this happened automatically; for those sites it did not.
• Fix: “Reset to Default” on the Prompt tab restored the pre-1.16.0 prompt, from a copy kept in the JavaScript that was never updated. The button now uses the plugin’s current defaults.
• Fix: turning SpamAnvil off did not stop the analysis. The switch on the General tab stopped new comments from being queued, but the background job kept processing what was already queued and kept picking up pending comments, spending API calls. Now the switch stops everything: the background job, the manual “Process queue” and “Scan pending” buttons, and Open Mode’s changes to WordPress’ comment settings. Queued comments wait and are processed once SpamAnvil is on again.
• Fix: a comment that a moderator had already handled could be overruled by the queue. The queue checked only that the comment still existed, so a comment sent to the trash while it waited could come back approved when its turn came. Now moderating a comment — approving it, marking it spam or trashing it, whether done by a person or another plugin — closes its queue entry without an API call. SpamAnvil also checks again right before applying a verdict, because a model can take a minute to answer: if someone decided in the meantime, the AI’s verdict is written to the log and the comment is left as that person set it. In Open Mode and Sync mode, where comments are published before analysis, an approved comment is still analyzed as before.
• Fix: the verdict cache could reuse a verdict for a different situation. It matched only the comment text and the author’s website, so the same words on another post, from another author, or after a prompt change got the old verdict for up to 7 days. The cache now matches only when everything the model would see is identical: text, post, author name, email and website, and the prompts. When a moderator overturns a verdict that came from the cache, that entry is deleted so the same text is not judged the same way again.
• Change: OpenRouter now uses free models only by default. Since 1.13.1 the default was “openrouter/free, openrouter/auto”: when the free models could not answer — about 4 calls in 10 — the paid openrouter/auto stepped in. An account without credit was never charged, but one with credit paid for part of the analysis without being told, while the setup wizard said the free option “costs nothing”. The default is now openrouter/free alone; when no free model answers, the comment waits in the queue and is retried later. Existing sites move to the new default only if they were still on a chain SpamAnvil wrote itself (the old default, or the one the 1.17.0 wizard stored); a chain you edited is left alone. To let a paid model step in again, add openrouter/auto at the end of the model list on the Providers tab.

1.18.1

• Fix: on sites with WP_DEBUG enabled, WordPress logged “Translation loading for the spamanvil domain was triggered too early” whenever the plugin had to (re)schedule its cron events. Scheduling runs on plugins_loaded and reaches the cron_schedules filter, where the interval’s label is translated — before WordPress is ready for translations. Schema check and cron scheduling now run on init instead. Verified against WordPress 7.1-RC4: the notice is gone and the events still schedule.
• Fix: 1.15.0 added a second set_transient( 'spamanvil_activation_redirect' ) inside the activator, which also runs on a database-version change — so a future schema bump would have redirected people to the settings screen out of nowhere. Removed; the activation hook has always set it.
• Correction to the 1.15.0 release notes. They stated that the post-activation redirect “never actually happened” because nothing set the flag it reads. That was wrong: spamanvil.php has set that transient since 1.1.1, and the redirect did fire. What 1.15.0 genuinely changed was its destination — unconfigured installs now land on the setup wizard instead of the settings page.
• Compatibility: WordPress 7.1 verified end to end on RC4 rather than by code review — activation, all admin screens, the comment form’s honeypot and signed time trap, an anonymous comment reaching the queue, a bot caught by the honeypot, per-IP rate limiting, and cron scheduling. No PHP notices, warnings or deprecations from the plugin.

1.18.0

• New: a screen to get back the comments that were flagged by mistake. The prompt rules removed in 1.16.0 had been auto-marking real readers as spam — a comment written in another language scored 75+, generic praise 70+. Fixing the rules does not bring those comments back, and WordPress deletes spam older than 30 days on its own, so they are recoverable only for a while. Settings → SpamAnvil → Logs now links to a review screen listing the spam-flagged comments that carry no link and no author website and whose score sits just above your threshold — the shape a wrongly flagged reader has, and the shape real spam almost never has. Each row shows the AI’s own reason for flagging it, and ticking a comment restores and publishes it. A dismissible notice points there while there is something to review. Verdicts from the honeypot, time trap, rate limit and heuristics are never listed: those are deterministic, and were never the prompt’s doing.