# Migration checklist

Sites that already carry a copy-pasted `SpamProtect.php` (pre-package rollout, 2026-06-30): americaninklings.com, capemaytraditions.com, compedgesolutions.us, ekkora.com, emmanuellc.org, gad.compedgesolutions.us, jlegacyrenovations.com, layerlytix.com, pageanvil.com, poison-ivy-removal.com, prayermap.me, stonesoup.us, tiyofi.com.

everymartian.com never received the library and was migrated directly from bespoke code — see that commit history for a worked example of a from-scratch integration, not a copy-paste replacement.

## Sites with no `composer.json` yet

capemaytraditions.com, ekkora.com, emmanuellc.org, gad.compedgesolutions.us, layerlytix.com, pageanvil.com, tiyofi.com

Bootstrap Composer first:

```bash
composer init --name="compedgesolutions/{site-slug}" --require="php:>=8.1" --no-interaction
```

## Sites with `composer.json` already

americaninklings.com, compedgesolutions.us, jlegacyrenovations.com, poison-ivy-removal.com, prayermap.me, stonesoup.us

Skip straight to adding the dependency below.

## All sites

1. Add the private repository and requirement to `composer.json`:
   ```json
   "repositories": [{"type": "vcs", "url": "git@github.com:SDMikel/spam-shield.git"}],
   "require": {"compedgesolutions/spam-shield": "^1.0"}
   ```
2. `composer install` (or `composer require compedgesolutions/spam-shield` if step 1 was skipped).
3. Replace `require_once '.../SpamProtect.php'` with `require_once __DIR__ . '/vendor/autoload.php'` (adjust the relative path to wherever `vendor/` lands for that project).
4. Delete the site's local copy of `SpamProtect.php`.
5. Confirm `SP_RATE_DIR` / `SP_HMAC_KEY` overrides (if the site defined its own) still take effect before the package's defaults kick in — they must be `define()`'d before `vendor/autoload.php` is required.
6. `php -l` the touched files, submit a real test form locally, then branch + PR per that project's own `MEMORY.md` merge policy.

## americaninklings.com — special case

This site is currently running **both** the old `includes/SpamProtection.php` class and the new library side by side, with the old class still doing the real gating work (`SpamProtection::renderFields()`, `SpamProtection::check()` for honeypot/timing/DB rate-limit, `SpamProtection::checkContent()` for content blocking and logging). Finishing this migration means:

1. Swap `SpamProtection::renderFields()` in the form template for `sp_render_fields()`.
2. Swap the honeypot/timing portion of `SpamProtection::check()` for `sp_honeypot_tripped()` / `sp_timing_ok()`.
3. Decide whether to move the DB-backed rate limit to `sp_rate_ok()` (file-based, per-IP, simpler) or keep a DB-backed wrapper if there's a reason the DB log is still needed elsewhere (e.g. an admin moderation view reads `activity_log`).
4. Fold the site's own keyword list (own-domain mentions, VA/outsourcing phrases) from `SpamProtection::checkContent()` into `sp_spam_score()`'s `$extraKeywords` argument, using the `ministry` overlay it's already closest to, or request a new `SP_SCAM_PHRASES`-style generic addition to the package if the terms aren't americaninklings-specific.
5. Delete `includes/SpamProtection.php` once nothing references it.