What's Changed

• fix: measure dwell time with the client's own clock, not two different ones by @2ndkauboy in #915
• fix: resolve the client IP even when core already filled it in by @2ndkauboy in #916
• fix: normalize the antispam_bee_detected_lang filter result like the API path by @2ndkauboy in #917
• fix: repair a rewritten comment form even when the honeypot casts no verdict by @2ndkauboy in #891
• fix: keep the debug log redacted when the filter returns an unusable value by @2ndkauboy in #894
• fix: stop rejecting a Windows absolute path for ANTISPAM_BEE_LOG_FILE by @2ndkauboy in #918
• feat: cache the outbound lookups rules perform by @2ndkauboy in #901
• fix: don't let an emptied-out pattern entry match everything by @2ndkauboy in #919
• ci: watch for WordPress releases newer than Tested up to (#805) by @faisalahammad in #851
• fix: add honeypot support for an input comment field by @faisalahammad in #852
• ci: bump asb-detection-compare to v1.12.0 by @2ndkauboy in #925
• feat: resolve both log files from WP_DEBUG_LOG-shaped constants by @2ndkauboy in #807
• fix: disable inactive rule checkboxes in delete-for-reasons by @faisalahammad in #853
• chore: update plugin version to 3.0.0-beta.5 by @2ndkauboy in #926

Full Changelog: 3.0.0-beta.4...3.0.0-beta.5

What's Changed

• fix: stop a stored scalar from fataling the settings read and save by @2ndkauboy in #898
• fix: do not call get_name() on rules that only have to implement Verifiable by @2ndkauboy in #897
• fix: map the six remaining language codes the detection service reports by @2ndkauboy in #892
• fix: count words separated by characters that only render as a blank by @2ndkauboy in #904
• fix: accept every country-list separator the rule already parses by @2ndkauboy in #902
• fix: unslash the email before hashing it, and honour the avatar setting again by @2ndkauboy in #903
• fix: treat a honeypot containing the literal "0" as filled in by @2ndkauboy in #895
• fix: escape the emitted honeypot attributes and quote the values spliced into the pattern by @2ndkauboy in #896
• fix: do not fatal the front end on empty comment-field markup by @2ndkauboy in #893
• fix: reject comments posted without the honeypot's secret field again by @2ndkauboy in #905
• fix: match approved commenters on author name and email by @2ndkauboy in #889
• feat: bring back the output-buffering honeypot injection for custom comment forms by @2ndkauboy in #907
• fix: verify comments created through the REST API by @2ndkauboy in #888
• fix: normalize payload slashing across comment channels by @2ndkauboy in #914
• fix: store a hyphenated reaction type under the key the read path uses by @2ndkauboy in #899
• feat: ship a Fail2Ban filter and guard the spam log format against it by @2ndkauboy in #845
• refactor: drop the duplicate options cache and keep the spam counter out of the settings by @2ndkauboy in #900
• Harden the GitHub Actions workflows by @2ndkauboy in #856
• chore: update plugin version to 3.0.0-beta.4 by @2ndkauboy in #913

Full Changelog: 3.0.0-beta.3...3.0.0-beta.4

This is a pre-release. It is meant for testing, not for production — please run it on a staging site, or one you can restore.

How to test and how to report · Testen und Rückmelden

Download antispam-bee.zip below and install it under Plugins → Add New → Upload Plugin. Settings from Antispam Bee 2.x are migrated automatically, and the 2.x options stay in the database, so going back is possible. When 3.0.0 is released it arrives as an ordinary plugin update.

What's Changed

• ci: attach the built plugin ZIP to every release by @2ndkauboy in #841
• chore: declare compatibility with WordPress 7.1 by @2ndkauboy in #846
• feat: read the IPLocate API key from a constant by @2ndkauboy in #814
• fix: stop advising against page caching for the comment time rule by @2ndkauboy in #843
• feat: rename the language filter to antispam_bee_allowed_languages by @2ndkauboy in #815
• ci: bump @wordpress/env to 11.15.0 for archived Debian bullseye by @2ndkauboy in #876
• fix: carry the linkback user agent into the payload and flatten nested values by @2ndkauboy in #860
• fix: validate the components registered through antispam_bee_general_options by @2ndkauboy in #861
• fix: tolerate non-array legacy multiselect values in the v2 migration by @2ndkauboy in #857
• fix: bound, surface and contain a failing v2 migration by @2ndkauboy in #863
• feat: report a migration that completed by @2ndkauboy in #868
• ci: derive the integration PHP version from .wp-env.json by @2ndkauboy in #869
• fix: verify comments that do not arrive through wp-comments-post.php by @2ndkauboy in #858
• fix: only treat a missing secret field as spam when the honeypot was injected by @2ndkauboy in #883
• feat: store the honeypot secret so field names survive page caches by @2ndkauboy in #834
• ci: move the test environment into its own wp-env configuration by @2ndkauboy in #877
• fix: let the spam score thresholds actually decide the verdict by @2ndkauboy in #880
• fix: map the individual language codes the detection service reports by @2ndkauboy in #881
• fix: invalidate the options cache when the option is created or deleted by @2ndkauboy in #882
• refactor: register hook callbacks as callables instead of closures by @2ndkauboy in #873
• fix: stop overwriting a supplied comment IP and drop the inert invalid-request key by @2ndkauboy in #884
• chore: add Rector to the static analysis toolchain by @2ndkauboy in #872
• refactor: add void return types to hook callback closures by @2ndkauboy in #874
• chore: add composer check to run the local checks in one command by @2ndkauboy in #875
• feat: dismissible pre-release admin notice (#812) by @faisalahammad in #850
• fix: point the pre-release notice at the wiki instead of the issue tracker by @2ndkauboy in #887
• chore: update plugin version to 3.0.0-beta.3 by @2ndkauboy in #885

New Contributors

• @faisalahammad made their first contribution in #850

Full Changelog: 3.0.0-beta.2...3.0.0-beta.3

What's Changed

• fix: return bool from _is_mobile() instead of raw strpos result by @thisismyurl in #693
• Add filter to change honeypot styles by @2ndkauboy in #624
• Fix validate_file() check to reject all invalid path codes by @thisismyurl in #699
• Fix upgrade_notice(): wrong hook tag (absolute path vs. plugin basename) and trailing space in array key by @thisismyurl in #698
• Escape action link URL and replace strip_tags() with wp_strip_all_tags() (Refs #534) by @thisismyurl in #716
• Use wp_get_word_count_type if available (WP 6.2+) by @Zodiac1978 in #717
• ci: attach the built plugin ZIP to every release by @2ndkauboy in #842
• Prepare release 2.11.13 by @2ndkauboy in #847

Full Changelog: 2.11.12...2.11.13

What's Changed

• chore: code cleanup (grammar, PHPDoc, simplification, tests) by @2ndkauboy in #765
• fix: resolve all PHPStan level 8 issues by @2ndkauboy in #766
• refactor: build normalized rule payload in the reaction by @2ndkauboy in #777
• docs: align hook DocBlocks with WordPress documentation standards by @2ndkauboy in #769
• test: add LinkbackFromMyself unit test coverage by @2ndkauboy in #773
• fix: let RegexpSpam rawurl patterns match by allow-listing the field by @2ndkauboy in #774
• ci: add spam-detection comparison workflow by @2ndkauboy in #778
• feat: wire up is_final() so definitive rules short-circuit the spam check by @2ndkauboy in #764
• ci: post the full-corpus comparison result on a pull request by @2ndkauboy in #783
• ci: expose the language service and tuning knobs on the manual trigger by @2ndkauboy in #784
• fix: address code review findings from 3.0.0-beta.1 by @2ndkauboy in #763
• ci: let the detection comparison choose between two corpora by @2ndkauboy in #785
• fix: detect languages in scripts without word delimiters (#776) by @2ndkauboy in #781
• chore: pin the E2E environment to WordPress 7.0 by @2ndkauboy in #803
• fix: collect the settings-tabs suite and make the seed post deterministic by @2ndkauboy in #804
• fix: read the delete-spam cron settings under the names that are written by @2ndkauboy in #800
• fix: tolerate a partial legacy option array in the v2 to v3 migration by @2ndkauboy in #799
• docs: note that issues merged into v3 must be closed by hand by @2ndkauboy in #806
• chore: integrate wp-since check, update workflows and ignore files by @2ndkauboy in #772
• ci: split tests.yml into per-concern workflows with path filters by @2ndkauboy in #809
• fix: skip the country lookup for addresses that have no country by @2ndkauboy in #816
• fix: keep invalid UTF-8 out of the regular expression patterns by @2ndkauboy in #818
• ci: pass the release tag via env: in attach-snapshot.yml by @2ndkauboy in #823
• fix: escape the slug in the unknown-rule spam reason text by @2ndkauboy in #824
• feat: let a filter choose the address the country rule looks up by @2ndkauboy in #817
• fix: stop sending an empty apikey to the geolocation service by @2ndkauboy in #821
• ci: add back a working plugin check workflow by @2ndkauboy in #813
• feat(regexp): add stable identifier keys to default spam patterns by @2ndkauboy in #782
• fix: resolve the remaining security review findings by @2ndkauboy in #825
• test: add an integration test harness and cover the v2 to v3 migration by @2ndkauboy in #794
• fix: derive the honeypot and debug log salt from wp_salt() by @2ndkauboy in #826
• fix: scope the nonce verification suppressions in CommentsColumns by @2ndkauboy in #831
• fix: derive the plugin path in the integration test scripts by @2ndkauboy in #832
• docs: replace the stale build badge with one badge per workflow by @2ndkauboy in #830
• refactor: introduce a DB_VERSION_OPTION_NAME constant by @2ndkauboy in #835
• fix: prefer a configured NONCE_SALT over the managed salt by @2ndkauboy in #833
• ci: pin every external action to a commit hash by @2ndkauboy in #810
• fix: let the settings sanitizers accept whatever was posted by @2ndkauboy in #836
• feat: log the spam reasons in the spam log file by @2ndkauboy in #797
• chore: update plugin version to 3.0.0-beta.2 by @2ndkauboy in #838

Full Changelog: 3.0.0-beta.1...3.0.0-beta.2

What's Changed

• WIP: First work on creating the rule classes by @angcl in #444
• WIP: CloudFest Hackathon - More work on Rules and Post Processors ... by @angcl in #446
• Better comment type handling by @MatzeKitt in #565
• [v3] clean up dependencies and fix codestyle pipeline by @stklcode in #575
• [v3] fix: add missing default return value to EmptyData rule by @stklcode in #576
• [v3] restore unit test environment by @stklcode in #578
• [v3] minor fixes, code style tweaks, extend phpdocs by @stklcode in #579
• [v3] add type hints to function signatures by @stklcode in #577
• Porting fix for #585 from v2 by @2ndkauboy in #622
• Add the missing type hint for get_placeholder() by @2ndkauboy in #629
• fix: use SCRIPT_NAME instead of REQUEST_URI to check path (#585) by @stklcode in #593
• fix: return bool from _is_mobile() instead of raw strpos result by @thisismyurl in #693
• Add filter to change honeypot styles by @2ndkauboy in #624
• Fix validate_file() check to reject all invalid path codes by @thisismyurl in #699
• Fix upgrade_notice(): wrong hook tag (absolute path vs. plugin basename) and trailing space in array key by @thisismyurl in #698
• fix: validate log file path before checking writability by @2ndkauboy in #701
• refactor: improve number formatting and pluralization in dashboard widgets by @2ndkauboy in #694
• feat: restore plugin list links from v2 by @2ndkauboy in #719
• fix: wrap settings tab navigation in nav element for accessibility by @2ndkauboy in #721
• test: migrate behat tests to playwright by @2ndkauboy in #695
• feat: restore upgrade notice display to v3 by @thisismyurl in #703
• ci: simplify test matrix and update actions by @stklcode in #733
• fix: make quotes optional in Honeypot inject() regex; add tests by @2ndkauboy in #731
• ci: enable test workflows on pull requests by @2ndkauboy in #726
• fix: raise comment_form_field_comment filter priority to 99 by @2ndkauboy in #730
• fix: resolve PHPCS error, deprecation warnings, and unused e2e fixture by @2ndkauboy in #735
• fix: delete antispambee_db_version option on plugin uninstall by @2ndkauboy in #728
• fix: remove load_plugin_textdomain() call by @2ndkauboy in #727
• fix: only determine client IP from REMOTE_ADDR via pre_comment_user_ip filter by @2ndkauboy in #729
• feat: add PHPStan static analysis by @2ndkauboy in #725
• feat: single-form tabbed settings page with client-side tab switching by @2ndkauboy in #722
• chore: add AI agent contribution guidelines by @2ndkauboy in #732
• chore: pre-beta cleanup (PHP guard, spelling, TODO removal) by @2ndkauboy in #749
• ci: prevent duplicate workflow runs on PR branches by @2ndkauboy in #750
• refactor: disambiguate component_type vs reaction_type naming by @2ndkauboy in #748
• docs: clarify that vendor/ is not project code in AGENTS.md by @2ndkauboy in #752
• feat: add support links next to Save button on General tab by @2ndkauboy in #724
• fix: use wp_get_word_count_type() if available (WP 6.2+) by @2ndkauboy in #734
• feat: add filter for post processor supported reaction types by @2ndkauboy in #754
• Get hidden and plugin field correctly by @2ndkauboy in #655
• feat: add Playwright e2e tests for tabbed settings page by @2ndkauboy in #723
• test(e2e): assert honeypot lets a genuine comment through by @2ndkauboy in #755
• Add ab_spam__invalid_request logic back to precheck() function by @2ndkauboy in #656
• test: Add a plugin check workflow by @2ndkauboy in #756
• chore(deps): update npm dependencies by @2ndkauboy in #757
• ci: add spell-checking workflow by @2ndkauboy in #759
• chore: update plugin version to 3.0.0-beta.1 and adjust readme entries by @2ndkauboy in #760

New Contributors

• @angcl made their first contribution in #444

Full Changelog: 2.11.12...3.0.0-beta.1

What's Changed

• fix: pass integer to _n() in dashboard spam counter by @robertstaddon in #692

New Contributors

• @robertstaddon made their first contribution in #692

Full Changelog: 2.11.11...2.11.12

What's Changed

• Add shorturl.fm spam pattern by @LIoccoUMD in #686

New Contributors

• @LIoccoUMD made their first contribution in #686

Full Changelog: 2.11.10...2.11.11

• Fix: remove build-tool warnings from minified Javascript and CSS resources (#682) (#683)
• Fix: remove leaked DOCKER_ENV file from deployment (#681)

• Tweak: Improved compatibility with unquoted HTML attributes in comment forms
• Maintenance: Tested up to WordPress 7.0