Replace Akismet with Gravity Forms Turnstile on corporate

[jpmckinney]

Align www.open-contracting.org with www.open-spending.eu, which uses Fluent Forms with Cloudflare Turnstile.

This is not a prerequisite for dropping Akismet — Gravity Forms has an official Turnstile add-on, free on every licence tier (gravityformsturnstile 1.5.0 appears in our licensed manifest). The case for migrating is coalition alignment.

What's actually in scope

Only one form is live:

Form	Fields	Live?
2 — Office Hours	11	Yes, /contact-office-hours/
1 — Contact us	11	No — not embedded on any published page

/about/contact/ returns 200 with no Gravity Forms markup; the only wp:gravityforms blocks are on page 29984 and one draft.

The live form: 4 text, 1 email, 3 select, 1 textarea, 1 checkbox; 3 conditional-logic fields; 83 choices (45 of them country names); one notification to {admin_email}; one message confirmation; no honeypot; 0 stored entries (notification-only).

Translation burden is zero

gravity_form-1   620 strings   613 translated   <- not published anywhere
gravity_form-2   192 strings     0 translated   <- the live one, authored in Spanish

Theme coupling is two filters

app/Providers/FormServiceProvider.php is the only Gravity Forms reference in the theme:

add_filter('gform_disable_css', '__return_true');
add_filter('gform_disable_form_theme_css', '__return_true');

There are no .gform/.gfield/.ginput selectors anywhere in the theme's SCSS. Gravity Forms' own CSS is disabled and forms inherit generic element styles from resources/scss/base/_forms.scss, so there is no form CSS to port.

Steps

• Install Fluent Forms and rebuild Office Hours (11 fields, 3 conditional rules, 83 choices)
• Configure Turnstile, as on the coalition site (_fluentform_turnstile_details)
• Set the notification to {admin_email} and the message confirmation
• Swap the two filters in FormServiceProvider for the Fluent Forms equivalent (Idea Bureau)
• Cut over page 29984; verify conditional fields, Turnstile, notification delivery and styling on staging
• Decide form 1's fate — rebuild, or export its 613 translations and retire it
• Remove gravityforms and akismet

Notes

Fluent Forms now has an official WPML bridge (multilingual-forms-fluent-forms-wpml) covering labels, placeholders and select/radio/checkbox choices. It is young (1.0.6) and WPML's certification was last tested against Fluent Forms 6.0.2. Only relevant if form 1 is rebuilt bilingually.

Refs #568

🤖 Generated with Claude Code

[jpmckinney]

• Remove Akismet. GravityForms uses it for spam filtering, so can't disable yet. But when possible, it would be:

# record API key
wp option get wordpress_api_key

# clear spam queue
wp comment delete $(wp comment list --status=spam --format=ids) --force

# uninstall
wp plugin uninstall akismet --deactivate

# clean up leftovers
wp option delete wordpress_api_key
wp option delete akismet_strictness
wp option delete akismet_show_user_comments_approved
wp option delete akismet_comment_form_privacy_notice
wp option delete akismet_spam_count
wp option delete widget_akismet_widget
wp option delete rg_gforms_enable_akismet

wp cron event delete akismet_scheduled_delete

# verify
wp cron event list --fields=hook | grep -i akismet
wp db query "SELECT COUNT(*) FROM ocp_commentmeta WHERE meta_key LIKE '%akismet%';"

[beneverard]

I had intentions of implementing Cloudflare turnstile, time got the best of me with annual leave. In addition, OCP do not pay for a license, you use our developer license provided via our support agreement.

[jpmckinney]

I have a local deployment now, so I can do timing. Gravity Forms is indeed heavier, but it's only 10-17ms versus 1-11ms per admin page (dashboard, post list, media library, etc.), so not worth migrating for that reason.

[jpmckinney]

Btw, when using any external service - let me know. For example, we should only be using OCP's Cloudflare account.

[jpmckinney]

As mentioned in #568 (comment) I completely disabled comments and pingbacks (bots were still submitting spam comments as recently as yesterday via e.g. attachment pages, POST'ing directly to /wp-comments-post.php, etc.). So, Akismet is now only used to process submissions to the form.

The current implementation disables all Gravity Forms CSS (gform_disable_css), which also means we can't use its honeypot feature, unless we add the CSS below. I tested locally, and the Gravity Forms Turnstile plugin doesn't depend on that CSS (Cloudflare injects an iframe).

.gform_validation_container {
    display: none !important;
}

I've renamed this issue.

Proposal

To @beneverard or @georgneu to agree.

I would:

1. wp install gravityformsturnstile or via https://www.open-contracting.org/wp-admin/admin.php?page=gf_addons
2. Enter the Turnstile keys
3. Add the Turnstile field to the form https://www.open-contracting.org/wp-admin/admin.php?page=gf_edit_forms&id=2
4. Test the form
5. Remove Akismet (instructions above)

The contact form on www.open-spending.eu has had no spam issues since adding Turnstile, so I think it's sufficient here.

Reasons against Akismet:

• It operates after submission, so a legitimate user gets no feedback that their message was considered spam.
• It could flag legitimate messages, so either we miss those, or someone needs to review spam.
• It sends PII data to Automatic (so another GDPR processor to track).
• It requires a license (though Idea Bureau covers it).
• It adds an orthogonal plugin (we mainly have WPML and ACF families, and then several miscellaneous).
• It adds weight to admin pages (though very little).

If we do get spam even with Turnstile, first step would be to use enableSubmitSpeedCheck in Gravity Forms.