Akismet 1.1.0 Tightens Webhook Security and Secret Storage

A security-focused update to the official Akismet module for Drupal changes how webhook callbacks and sensitive configuration are handled. Akismet Anti-Spam 1.1.0, released on 2 October 2026, also adds Drupal 12 support and a one-way migration path from the older community-maintained module. The integration is maintained by Automattic.

The security changes require attention from administrators upgrading existing installations. Previously exported configuration may still contain a secret used to hash email addresses, while sites using reverse proxies must check how webhook rate limits are applied. Administrators replacing the older community module also face changes to stored spam records and form protection. These migration implications were covered in an earlier The DropTimes roundup, while the latest release documentation provides further details about security and configuration handling.

One security fix changes how Akismet determines the address used for webhook callbacks. The callback carries the site's Akismet API key, and the previous handling could allow a forged request to redirect it. Version 1.1.0 derives the callback address from a trusted site address, preventing that redirection. The module also rejects repeated invalid webhook requests from the same address, applying a limit of 50 attempts per hour.

Sites operating behind a reverse proxy, load balancer or content delivery network must configure reverse_proxy and reverse_proxy_addresses correctly in settings.php. According to the release notes, this allows the webhook limit to apply to individual callers rather than treating traffic passing through a shared proxy address as originating from one source.

Another security change moves the secret used for hashing email addresses out of exportable Drupal configuration. New configuration exports therefore no longer write that secret into repositories. However, administrators who previously exported akismet.settings.yml must remove the existing hmac_key entry from their synchronised configuration before exporting again. The release notes warn that a previously committed value should be treated as exposed. This hashing secret is separate from the Akismet API key involved in webhook communication.

Additional changes prevent usernames and passwords embedded in a site's configured URL from being transmitted to Akismet. Registration logs now record a hash instead of the user's email address, and Views fields displaying moderator spam verdicts require an Akismet permission. The module also introduces a persistent warning when an API key remains in stored configuration despite being overridden through settings.php or the Key module. Administrators can remove that redundant key through a dedicated form.

The release also supports migration from the unsupported community Akismet module to the official Akismet Anti-Spam integration. The process is available to eligible sites running Drupal 10.3 or later and preserves the API key, supported connection timeout and selected comment, contact and registration protection settings. However, the migration is one-way and deletes the previous module's akismet database table, including historical submissions that may contain email addresses and IP addresses.

Automattic's migration documentation, updated on 8 October 2026, explains that the old records are removed because the official module cannot subsequently fulfil erasure requests for them. Administrators are instructed to back up the database before proceeding. The migration also replaces existing form configurations and actions, and it produces a report identifying which settings were retained, changed or discarded.

Form protection can change after the takeover. The community module supported settings for individual comment types and contact forms, while the official integration uses broader protection categories. Some forms may therefore receive checks that were not previously enabled. The official module also blocks contact form submissions identified as blatant spam by default, while individual Webforms require their Akismet handlers to be configured again. Previously protected forms that the new module does not support, including certain user profile and password reset forms, lose that protection. The older bypass permission is also removed from existing roles and must be reviewed separately.

Deployment order is important during this migration. Administrators must remove the old Composer package without uninstalling the module from Drupal, install the official package, rebuild caches using drush cr, and then run database updates with drush updb. The migration guide warns that cached references to removed classes can otherwise cause HTTP 500 errors and Drush failures. Spam protection remains inactive until the database updates finish. Administrators must then review the migration report, export configuration and test protected forms before completing deployment across their environments.

For sites already using version 1.0 of the official module, the update follows a simpler path through Composer and database updates. The Akismet team advises updating dependencies alongside the module because version 1.1.0 requires a newer release of its PHP software development kit.

Drupal 12 compatibility is another addition, although support varies by integration. The release notes report testing comment, registration and contact form protection against Drupal 12.0.0-beta1. Contact is supplied separately as drupal/contact on Drupal 12, so support for that integration depends on the separate project. Integrations involving Webform, Contact Storage, Key, Honeypot, CAPTCHA and Antibot had not been verified on Drupal 12 at the time of release. Akismet's own PHP requirement begins at PHP 8.1, but Drupal 12 requires PHP 8.5.

Other improvements include transmitting previously collected browser interaction signals to Akismet's spam scoring service, expanding personal data exports to JSON, CSV and YAML, and excluding moderator identity information from those exports. The module also holds comments for review during subscription suspension, retries feedback delayed by API rate limits and handles empty Key provider values without breaking protected forms. Although the developer expects the additional browser signals to improve detection, no comparative accuracy measurements were provided.

Further information about security changes, upgrade requirements and Drupal 12 support is available in the Akismet Anti-Spam 1.1.0 release notes. Administrators moving from the community module should also consult the official migration guide on Drupal.org before updating.