wiki/knowledge/wordpress/didion-form-spam-akismet-smtp.md · 786 words · 2026-04-05

Didion Form Spam & Plugin Issues — WP Mail SMTP Pro & Akismet

Overview

During a routine form test on the Didion website, the team discovered that new "Request a Sample" form submissions were not populating the tracking Google Sheet — despite email notifications firing correctly. Investigation revealed two critical WordPress plugins had been deactivated, and the Google Sheet contained approximately 1,500 spam submissions that had accumulated undetected.

This issue is likely common on sites that have transferred between hosting agencies without a full plugin license audit.

What Was Found

Broken Form-to-Google-Sheet Integration

The form submission flow was partially working: submitters received a confirmation email, and Didion staff received a notification email.
However, submissions were not reaching the Google Sheet used for centralized tracking.
The Google Sheet integration runs through Zapier, which connects the Gravity Forms submission to the sheet.
The Zapier connection itself appeared intact (spam submissions were reaching the sheet), suggesting the issue may be specific to the new landing page form not being wired into the existing Zap.

~1,500 Spam Submissions in Google Sheet

While checking whether the test submission had populated the sheet, the team noticed a massive volume of spam entries — approximately 1,500 rows — submitted in rapid succession.
Submissions appeared to originate from gambling/casino bots (e.g., "online live roulette") and were clustered within seconds of each other.
Not all spam submissions had reached the Didion email inbox, suggesting some filtering was occurring at the email level, but the Google Sheet had no such protection.

Two Key Plugins Found Deactivated

Inspection of the WordPress plugin dashboard revealed two anti-spam/email plugins were installed but not active:

Plugin	Purpose	Status
WP Mail SMTP Pro	Routes outgoing email through authenticated SMTP to prevent spam filter issues and improve deliverability	Inactive — license not activated
Akismet Anti-Spam Protection	Blocks spam form submissions before they are processed	Inactive — API key not configured

Both plugins required license/API key activation that appeared to have lapsed or never been transferred to Didion's ownership.

Root Cause Hypothesis

The plugins were likely active and licensed under a previous web agency that hosted the Didion site. When the site was transferred, the agency's licenses were not migrated, causing the plugins to silently deactivate. No alert was triggered at the time of transfer.

"Maybe it was connected with the previous agency or something, who knows, right? But then it went away." — Diana Henry

This is a known risk pattern when WordPress sites change hands without a formal plugin license audit. See ^[1] for recommended handoff steps.

Resolution Steps Taken

WP Mail SMTP Pro — Activated the plugin during the call. License activation is still required; Melissa to follow up with the web dev team (Eshak, Mark) to obtain or renew the license.
Akismet — Activated the plugin during the call. Requires an API key to function; needs an account/subscription to be set up under Didion's ownership.
Zapier connection — Melissa to audit the existing Zap to confirm the new landing page form is included and routing correctly to the Google Sheet.
Web dev escalation — Melissa sent a note to Eshak and Mark documenting what was found and requesting their recommendations.

Outstanding Items

[ ] Confirm WP Mail SMTP Pro license is activated and functioning
[ ] Set up Akismet API key under a Didion-owned account
[ ] Audit Zapier Zap to connect new Masa/Arepa landing page form to the existing Google Sheet
[ ] Clean up ~1,500 spam rows from the Google Sheet
[ ] Test a new form submission end-to-end (email notification + Google Sheet population)

Lessons & Generalizations

Plugin licenses are tied to the account that purchased them. When a site transfers between agencies or hosting environments, any premium plugin licenses (SMTP, anti-spam, SEO tools, etc.) must be explicitly re-licensed under the new owner. This should be a standard checklist item during any site migration.

Email delivery ≠ spam protection. WP Mail SMTP Pro handles outbound email routing (preventing legitimate emails from being flagged as spam), while Akismet handles inbound form submission filtering. These are complementary, not redundant — both should be active on any production WordPress site using contact or lead-gen forms.

Zapier integrations are not automatically inherited by new forms. Adding a new form (e.g., on a new landing page) requires explicitly adding it to the relevant Zap, even if other forms on the same site are already connected.

^[2]
^[3]
^[1]
^[4]