Stop Spam Before It
Reaches Your Inbox

// Add to your form handler (e.g. contact.php)
$token   = trim($_POST['sg_token'] ?? '');
$api_key = 'sg_your_api_key'; // ← your SpamSlap key
$domain  = 'yoursite.com';    // ← your domain
$base    = 'https://admin.fixflex.co.uk/spamslap';

if ($token) {
    // Token present — user went through AI check. Just verify it (fast).
    $ctx = stream_context_create(['http' => [
        'method'  => 'POST',
        'header'  => "Content-Type: application/json\r\n",
        'content' => json_encode(['api_key' => $api_key, 'sg_token' => $token]),
        'timeout' => 8, 'ignore_errors' => true,
    ]]);
    $res = @file_get_contents($base . '/api/verify-token', false, $ctx);
    $ok  = $res && (($d = json_decode($res, true)) !== null) && !empty($d['valid']);
    if (!$ok) {
        http_response_code(422);
        echo json_encode(['error' => 'Security check failed. Please try again.']);
        exit;
    }
} else {
    // No token — bot bypassed JS. Run full AI check as fallback.
    $ctx = stream_context_create(['http' => [
        'method'  => 'POST',
        'header'  => "Content-Type: application/json\r\n",
        'content' => json_encode([
            'api_key' => $api_key,
            'email'   => $_POST['email'] ?? '',
            'message' => $_POST['message'] ?? '',
            'domain'  => $domain,
        ]),
        'timeout' => 10, 'ignore_errors' => true,
    ]]);
    $res = @file_get_contents($base . '/api/check', false, $ctx);
    if ($res && (($d = json_decode($res, true)) !== null) && !empty($d['is_spam'])) {
        http_response_code(422);
        echo json_encode(['error' => $d['message'] ?? 'Spam detected.']);
        exit;
    }
}
// All clear — process the form normally

// Express / any Node.js backend
const SPAMSLAP_KEY  = 'sg_your_api_key'; // ← your SpamSlap key
const SPAMSLAP_BASE = 'https://admin.fixflex.co.uk/spamslap';
const DOMAIN        = 'yoursite.com';    // ← your domain

app.post('/contact', async (req, res) => {
  const { sg_token, email, message } = req.body;

  if (sg_token) {
    // Token present — verify it (user went through AI check)
    const r = await fetch(`${SPAMSLAP_BASE}/api/verify-token`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ api_key: SPAMSLAP_KEY, sg_token }),
      signal: AbortSignal.timeout(8000),
    }).then(r => r.json()).catch(() => null);
    if (!r?.valid) return res.status(422).json({ error: 'Security check failed.' });
  } else {
    // No token — bot bypassed JS. Full AI check as fallback.
    const r = await fetch(`${SPAMSLAP_BASE}/api/check`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ api_key: SPAMSLAP_KEY, email, message, domain: DOMAIN }),
      signal: AbortSignal.timeout(10000),
    }).then(r => r.json()).catch(() => null);
    if (r?.is_spam) return res.status(422).json({ error: r.message });
  }
  // All clear — process the form normally
});

# Flask / Django / FastAPI
import requests

SPAMSLAP_KEY  = 'sg_your_api_key'  # ← your SpamSlap key
SPAMSLAP_BASE = 'https://admin.fixflex.co.uk/spamslap'
DOMAIN        = 'yoursite.com'     # ← your domain

def check_spamslap(post_data):
    token = post_data.get('sg_token', '').strip()
    try:
        if token:
            # Token present — verify it (fast, no extra AI call)
            r = requests.post(
                f'{SPAMSLAP_BASE}/api/verify-token',
                json={'api_key': SPAMSLAP_KEY, 'sg_token': token},
                timeout=8
            )
            return r.json().get('valid', False), None
        else:
            # No token — bot bypassed JS. Full AI check as fallback.
            r = requests.post(
                f'{SPAMSLAP_BASE}/api/check',
                json={
                    'api_key': SPAMSLAP_KEY,
                    'email':   post_data.get('email', ''),
                    'message': post_data.get('message', ''),
                    'domain':  DOMAIN,
                },
                timeout=10
            )
            d = r.json()
            return not d.get('is_spam', False), d.get('message')
    except Exception:
        return True, None  # fail-open if SpamSlap unreachable

# In your view / route handler:
is_clean, err = check_spamslap(request.form)
if not is_clean:
    return {'error': err or 'Spam detected.'}, 422
# All clear — process the form normally