Overview
Contact forms help visitors reach you through your website but can also be security weak points. This guide shows MODX developers and site owners how to keep your forms secure while letting genuine visitors contact you.
Unprotected Contact Forms Can Become Spam Gateways
Contact forms (and similar forms) are open doorways on your website. Unlike login screens or checkout pages that have built-in security, contact forms are meant to be accessible to everyone. This openness makes them prime targets for misuse.
Why Do People Try to Misuse Contact Forms?
Understanding the motivations behind form abuse is crucial to protecting your website effectively.
The Troublemaker's Playbook
-
Sending Unwanted Messages Bad actors use contact forms to:
- Spread spam advertising
- Send messages to multiple email addresses
- Harvest legitimate email addresses for future misuse
-
Information Gathering Some attackers use forms to:
- Test website responsiveness
- Verify active communication channels
- Probe for potential system vulnerabilities
-
Operational Disruption Repeated form abuse can:
- Overwhelm support resources
- Consume server bandwidth
- Create noise to mask other malicious activities
Consequences of Contact Form Abuse and Spam
Reputation Risks: Digital Communication Nightmare
Domain and IP Blacklisting and ESP Ban
When your website sends spam, you face a multi-pronged attack on your digital communications:
Domain Blacklisting Your email domain gets flagged as a spam source, meaning:
- Critical business emails may never reach their destination
- Your communication channels become unreliable
- Rebuilding email reputation can take months or years
IP Blacklisting If you're sending emails directly from your server, the risks multiply:
- The server's IP address can be blocked by email providers
- All emails from your IP become suspect
- In MODX Cloud we may disable email for your account
- Multiple services might refuse your communications
Email Service Provider (ESP) Ban If you are sending email using a third-party service.
- Your email reputation can damage the IP reputation of the provider
- The provider may suspend or restrict email sends
- In high-volume scenarios, they could ban you
- Finding another service provider is disruptive and you may have issues if your domain reputation.
Communication Breakdown
Unprotected forms lead to:
- Legitimate inquiries getting lost in spam noise
- Support teams wasting hours sorting fake messages
- Potential customers losing trust in your communication channels
Technical Challenges: Hidden Operational Costs
Resource Consumption
Spam submissions aren't just annoying—they're a direct infrastructure attack:
- Automated bots can overwhelm server processing capabilities
- Increased bandwidth and CPU usage
- Risk of service throttling or suspension
Denial of Service Risks
Sophisticated spam attacks can:
- Make your website unresponsive
- Block legitimate user interactions
- Create unexpected downtime
- Generate significant unexpected operational costs
The Broader Impact
An unprotected contact form is more than a technical problem—it's a business risk that can:
- Erode customer trust
- Waste valuable resources
- Compromise your digital reputation
- Disrupt critical business communications
Comprehensive form protection isn't just about blocking spam—it's about safeguarding your online presence.
Contact Forms in MODX
For MODX Revolution-based websites, the go-to Extra for Forms is FormIt. FormIt has several Extras and configurations that can help prevent spam abuse. However, there are some configurations we see such as user-submitted content being sent in autoreplies that make forms especially attractive to spammers. All of the following strategies can be used and layered to prevent contact form spam and abuse.
Recommended Protection Strategies
This next section guides you through some effective tools and strategies to protect your contact forms from automated attacks and malicious users. From properly handling user-submitted content to implementing technical solutions like CSRF protection and hidden spam fields, these recommendations create a multi-layered defence system that balances security with user experience. By putting these protection measures in place, you can significantly reduce form spam while keeping your forms accessible and functional for genuine visitors.
Avoid User-Submitted Content in Autoreplies
The Danger of User-Submitted Content in Emails
One of the most significant risks with contact forms is how people might misuse the ability to submit content. This is especially problematic because contact forms often trigger emails containing user-submitted content - which is one of the key reasons contact form abuse happens. Imagine receiving an email confirmation that includes whatever text someone typed into your form. This might seem harmless, but it's an invitation for abuse.
Why User-Submitted Content in Emails is Risky
- Spammers can insert email addresses of unsuspecting victims
- Malicious users can send spam to multiple email addresses
- Your domain could be blocked as a source of spam
- You might lose access to critical email services
Golden Rule: Never include user-submitted content in automatic email responses.
- Use only pre-written, static content in email confirmations
- Never include form submission text in auto-responses
- Provide a generic confirmation message
Example of a Safe Autoresponse:
Subject: Message Received
We have received your message and will review it shortly.
Reference Number: [UNIQUE_SYSTEM_GENERATED_ID]
Thank you for contacting us.
Spam Prevention
Use FormIt's spam hook to block automated submissions:
[[!FormIt?
&hooks=`spam`
&spamEmailFields=`email`
&validate=`email:email`
]]
CSRF (Cross-Site Request Forgery) Protection
While Cross-Site Request Forgery (CSRF) protection is primarily understood as a security mechanism, it also serves as an effective deterrent against automated form spam and abuse. The implementation of CSRF protection introduces additional friction that makes mass form submissions significantly more challenging for malicious actors.
How CSRF Helps Prevent Spam
Traditional spam bots operate by quickly and repeatedly submitting forms with minimal interaction. CSRF protection disrupts this automated workflow by introducing essential verification steps:
- Page Interaction Requirement: A CSRF-protected form typically requires the attacker to:
- Fully load the page containing the form
- Retrieve a unique CSRF token
- Include that token with each submission
- Computational Overhead: Each form submission now demands more complex interactions:
- Bots must simulate full-page loads
- Parse and extract unique tokens
- Construct more sophisticated submission requests
- Reduced Automation Efficiency: These additional steps dramatically increase the:
- Time required for each form submission
- Computational resources needed
- Complexity of scripting automated attacks
Practical Impact on Spam Prevention
For seemingly less critical forms like contact forms, CSRF protection offers a nuanced layer of defense. While not an absolute barrier, it significantly raises the bar for potential spammers:
- Automated scripts must become more complex
- Mass submissions become computationally expensive
- Many basic spam tools become ineffective
By implementing CSRF protection, you're not just securing against cross-site request forgery—you're creating an intelligent, adaptive barrier that makes automated form abuse substantially more difficult and resource-intensive.
Hidden Spam Field
The Invisible Spam Trap
Sometimes the most effective security is nearly invisible. The hidden spam field is a technique that looks simple but can be incredibly powerful in stopping automated form submissions.
How It Works: Automated spam bots typically try to fill out every field they encounter. By creating a special hidden field that must remain completely empty, we create a clever trap that only these mindless bots will fall into.
The Right Way to Hide a Field
When hiding a form field, we need to be careful. Simply using display: none; can cause accessibility issues and might not fool all spam bots. Instead, we use a more nuanced approach:
.hidden-spam-field {
position: absolute;
opacity: 0;
top: 0;
left: 0;
height: 0;
width: 0;
z-index: -1;
pointer-events: none;
border: 0;
margin: 0;
padding: 0;
overflow: hidden;
}
This CSS does more than just hide the field:
- It removes the field from the page layout
- Prevents any visual or interactive interference
- Ensures screen readers and assistive technologies ignore the field
- Creates a trap specifically designed to catch automated bots
Implementing the Hidden Spam Field
<input
type="text"
name="workemail"
class="hidden-spam-field"
tabindex="-1"
aria-hidden="true"
/>
And in your FormIt configuration:
[[!FormIt?
&validate=`workemail:blank`
]]
Important Considerations
- Never use an existing field name
- Choose a name that looks attractive to bots
- Combine this with other spam prevention techniques
Why This Matters
This technique adds an intelligent layer to your form's defense:
- Invisible to human users
- Automatically blocks most automated spam submissions
- Maintains your form's accessibility and user experience
Advanced Filtering with Rampart
Rampart for FormIt in MODX provides robust anti-spam protection for your forms. Install Rampart in the MODX Revolution Extras Installer and add to your FormIt Call (similar to the below example) to enable IP blacklisting, and honeypot fields that catch automated submissions. This integration works alongside Rampart's other features like DNS blacklisting through Project Honey Pot, offering a strong defence against form spam.
[[!FormIt?
&hook=`hook.RampartFormIt`
&rptErrorField=`rampart`
&submitVar=`contact_me`
]]
/* somewhere in my form */
[[!+fi.error.rampart]]
Rampart provides enhanced protection:
- Global IP blacklist management
- Real-time threat detection
- Comprehensive logging
- Advanced filtering mechanisms
Web Application Firewall (WAF)
Implement a WAF to:
- Prevent high-volume attacks
- Block submissions from suspicious locations
- Filter server-level threats
Recommended WAF Options:
- CloudEdge for MODX Cloud
- Cloudflare
- Imperva
Akismet Spam Protection
Akismet may be familiar to folks who use WordPress. It's available a the Akismet Extra and can be integrated into FormIt as another way to protect your site from form spam. The Akisment Extra is free, however, Akismet is a service by Automattic and while it's free for personal projects, its license requires a paid subscription for commercial projects.
CAPTCHA: One Last Tool
CAPTCHA is a type of test that tries to distinguish humans from computers. Some operate as invisible scripts on a page, some will request input from you such as those reCAPTCHA tests where you need to click boxes with street lights or motorcycles. These are often not ideal from a user experience perspective and can create a lot of frustration for visitors just trying to get in touch with your organization. In addition, they generally rely on third-party Javascript from external service providers such as Google or Cloudflare and can reduce performance on pages where CAPTCHA is applied. As such, we generally only recommend it when your site or forms have already been targeted for abuse.
Here are some things to keep in mind for CAPTCHA:
- Choose accessible CAPTCHA options
- Implement as a final protection layer
- Minimize user friction
Recommended CAPTCHA Extras for FormIt:
Conclusion
Protecting your contact forms is about creating multiple layers of defence. By understanding the risks, implementing strategic protections, and staying vigilant, you can maintain an open communication channel while effectively mitigating potential abuse.
Need Help Implementing Contact Form Protections?
If you read through this page and you're not sure what to do, the MODX Support team has got your back. Contact MODX Support here or use the Help button inside the MODX Cloud Dashboard and we'll help ensure your website forms are configured safely.
Additional Resources
- MODX Security Documentation
- FormIt Documentation
- CSRF Helper Extra