Skip to main content

Refuse Fake Donation Reports Before They Reach Your Integrations

Free Intermediate

In link mode, POST /listener-support/donations has to be public: the listeners reporting a Ko-fi or PayPal tip are not logged in. Benecaster limits unverified reports to five per hour from any one address; the benecaster_listener_support_accept_donation filter is where a site adds its own rules.

The part that matters: the filter runs before the row is written, so a refused report never fires benecaster_listener_support_donation_logged — your CRM sync, Slack alert and the thank-you email all stay quiet. Hooking that action to undo a fake is too late: the row exists and every other listener has already run.

Code

<?php
add_filter( 'benecaster_listener_support_accept_donation', function ( bool $accept, array $submission ): bool {
    if ( ! $accept ) {
        return false;
    }
    // A webhook that passed its signature check is trustworthy — keep it.
    if ( $submission['verified'] ) {
        return true;
    }
    // Hand-reported donations: only from platforms this show uses, and with a reference.
    if ( ! in_array( $submission['canonical_platform'], [ 'kofi', 'paypal' ], true ) ) {
        return false;
    }
    return null !== $submission['reference'] && '' !== $submission['reference'];
}, 10, 2 );

View on GitHub →

Hooks Used

Need this built rather than just documented? See our services →