Protect a WordPress form from spam bots, without a plugin

<?php
// wp-config.php, above the line “That's all, stop editing!”.
define('ANTISY_SITE_KEY', 'VOTRE_CLE_DE_SITE');                  // public: it goes in the page
define('ANTISY_SECRET', 'VOTRE_SECRET_DE_VERIFICATION');         // secret: never in the repository of a theme

// In antisy.php, replace this line of the function of the documentation:
'secret' => getenv('ANTISY_SECRET'),
// with this one:
'secret' => ANTISY_SECRET,

<?php
// In a plugin of your own, or in the functions.php of the theme: the tag, in the <head> of every page.
add_action('wp_head', function () {
    if (!defined('ANTISY_SITE_KEY')) {
        return;
    }
    printf(
        '<script src="https://api.antisy.com/v1/i/l.js" data-site="%s" defer></script>' . "\n",
        esc_attr(ANTISY_SITE_KEY)
    );
});

// The antisy_verdict() function of the documentation, saved in antisy.php next to this file.
require_once __DIR__ . '/antisy.php';

<?php
/**
 * Vérifie le jeton Antisy (mode simple). Rend le verdict : "allow" ou "deny".
 *
 * - jeton vide ou absent : envoyé tel quel, Antisy décide ; jeton non vide inutilisable : "deny", sans appel ;
 * - Antisy ne répond pas (réseau, délai, 5xx) : "allow" et on journalise (fail-open) ;
 * - 429 : ANTISY_ON_RATE_LIMIT ;
 * - tout autre statut que 200 (400, 401, 413, 415...) : erreur de VOTRE appel, journalisée,
 *   tentative non vérifiée : "deny". Jamais "allow".
 */
const ANTISY_ON_RATE_LIMIT = 'allow'; // 'deny' for a sensitive form: an attacker can cause a 429

function antisy_verdict(mixed $token): string
{
    if ($token === null) {
        $token = ''; // missing field: treated as empty
    }
    // Empty: sent as it is, Antisy decides (collection on: deny; off: the engine decides).
    // Not empty: 1 to 2,048 printable ASCII characters; /D: “$” does not tolerate a final line break.
    if ($token !== '' && (!is_string($token) || !preg_match('/^[\x20-\x7e]{1,2048}$/D', $token))) {
        return 'deny'; // a form array, a token too long or crafted: what Antisy would answer
    }

    $ch = curl_init('https://api.antisy.com/v1/siteverify');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 3, // seconds; beyond that, fail-open
        CURLOPT_FOLLOWLOCATION => false, // no redirect followed (the default, written so that no one turns it on): a 3xx is an error of YOUR call
        CURLOPT_POSTFIELDS => http_build_query([
            'secret' => getenv('ANTISY_SECRET'), // siteverify secret; never hard-coded nor on the client side
            'response' => $token,
        ]),
    ]);
    $body = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    $error = curl_error($ch);
    curl_close($ch);

    // The only case where the submission is let through: Antisy does not answer.
    if ($body === false || $status >= 500) {
        error_log("Antisy injoignable, envoi laissé passer (fail-open): {$error} (HTTP {$status})");
        return 'allow';
    }
    if ($status === 429) {
        error_log('Antisy 429 (voie saturée): ' . ANTISY_ON_RATE_LIMIT);
        return ANTISY_ON_RATE_LIMIT;
    }
    if ($status !== 200) {
        error_log("Antisy HTTP {$status} : erreur de l'appel, à corriger ; tentative non vérifiée");
        return 'deny';
    }
    $result = json_decode($body, true);
    if (is_array($result) && is_bool($result['success'] ?? null)) {
        if ($result['success']) {
            return 'allow'; // the only acceptance
        }
        return 'deny'; // success false: refusal (the verdict is “deny”)
    }
    error_log('Réponse Antisy illisible, tentative non vérifiée');
    return 'deny';
}

<?php
// Comments: the WordPress form sends its fields to wp-comments-post.php, on your site.
// This hook runs before the comment is processed.
add_action('pre_comment_on_post', function () {
    if (antisy_verdict($_POST['antisy-token'] ?? '') !== 'allow') {
        wp_die('Envoi refusé.', 'Envoi refusé', ['response' => 403, 'back_link' => true]);
    }
});

<form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
  <input type="hidden" name="action" value="antisy_contact">
  <label>Nom <input name="name" autocomplete="name"></label>
  <label>E-mail <input name="email" type="email" autocomplete="email"></label>
  <label>Message <textarea name="message"></textarea></label>
  <button>Envoyer</button>
</form>

<?php
function antisy_contact_handler(): void
{
    if (antisy_verdict($_POST['antisy-token'] ?? '') !== 'allow') {
        wp_die('Envoi refusé.', 'Envoi refusé', ['response' => 403, 'back_link' => true]);
    }

    // … clean the fields, then send or save the message (wp_mail, post, database…)

    wp_safe_redirect(home_url('/merci/'));
    exit;
}
add_action('admin_post_nopriv_antisy_contact', 'antisy_contact_handler'); // visitor not logged in
add_action('admin_post_antisy_contact', 'antisy_contact_handler');        // visitor logged in

{
  "success": true,
  "verdict": "allow",
  "flags": [],
  "error-codes": [],
  "challenge_ts": "2026-09-24T10:00:00Z",
  "hostname": "shop.example",
  "action": "contact",
  "event_id": "evt_01J7X4M2Q9K8ZP3R5T6V7W8Y9A"
}