If you are creating a corporate site with WordPress, the plug-in that is often used to create an inquiry form is “Contact Form 7”.
Contact Form 7 is convenient because you can easily set up an inquiry form, but on the other hand, vulnerabilities have been reported, and I think many people are worried about security.
Since there is a risk of information leakage of customer’s personal information in the form, security measures must be emphasized.
This time, I will explain the security risks of Contact Form 7, the damage caused by them, and the countermeasures. We will also introduce a tool that allows you to create a form with perfect security measures, so please refer to it.
What is Contact Form 7
“Contact Form 7” is a WordPress plug-in (extension) that allows even those with little programming knowledge to easily set up a contact form.
It has all the basic functions required for forms, such as setting automatic reply emails and setting input completion screens, and is used all over the world.
Since the developer is Japanese, there is a lot of information in Japanese, and it is easy to find a solution even if there is something you do not understand. You can also ask questions from the FAQ on the official website or from the window in WordPress.
Despite the convenience of Contact Form 7, there are some security concerns.
Contact Form 7 security risks
Contact Form 7 is an open source (source code is published) plug- in and has many users, so there are various security risks.
Here, we will explain the security risks when operating forms using Contact Form 7 .
Vulnerability may be exploited
Various vulnerabilities have been reported in Contact Form 7 so far, and exploiting those vulnerabilities may lead to problems such as leakage of personal information and site alteration.
In December 2020, a vulnerability was discovered that allowed unlimited file uploads to forms created with Contact Form 7.
A malicious user could exploit this vulnerability to send large numbers of files containing viruses. You can also upload files that contain script files that can be executed on the host server, leaving your site vulnerable to tampering.
Currently, it has been improved by updates, but if a vulnerability is found in Contact Form 7, it may be subject to various attacks.
spam is sent
Contact Form 7 does not have a default anti-spam feature, so there is a risk of spam being sent through the form.
Spam emails are automatically sent by programs called “bots”, so thousands or tens of thousands of spam emails are sent every day.
Accidentally clicking on a link in the body of a spam email can cause devastating consequences, including virus infection and spyware that steals your customer’s personal information. If you use Contact Form 7 to create your form, you have to take extra measures against spam.
Abuse of autoresponder emails
In Contact Form 7, you can set automatic reply mail, but if the automatic reply mechanism is abused, the company may become a perpetrator of spam mail. Here are some ways that auto-reply emails can be abused:
- The attacker enters the email address of the user they want to send spam emails to in the email address input field of the form.
- Paste a harmful link URL such as a phishing site in the inquiry field
- Attacker submits the form and an auto-reply email is sent to the third-party email address entered
With this trick, spam emails containing harmful URLs are sent to third parties from your company’s form. Submitted from a company-operated form, it causes a significant loss of trust.
Damage Caused by Contact Form 7 Security Risks
If the security risks of Contact Form 7 are left unattended, various problems such as information leakage and data falsification will occur.
I will explain what kind of damage you will suffer if a security problem occurs.
harm to customers
The first possible damage is damage to the customer. Customers’ personal information can be used by malicious users by clicking links in spam emails or by exfiltrating customers’ personal information through external attacks.
Not only is the information misused, but users also perceive it as a company that leaks personal information.
In addition, if a security problem occurs and the service or form that the company provides is suspended, the customers using the service will also be affected.
Corporate credit decline
If problems such as personal information leaks occur, trust in the company will decline.
Once trust in a company is lost, that trust cannot be easily regained, and the bad reputation written on the Internet about the company persists.
Even if security measures are strengthened later, the bad reputation that remains on the Internet will haunt the image of a company that leaked information due to poor security measures, and sales may decline.
Cost of dealing with damage
Damage caused by security issues can be costly to deal with. If the customer suffers damage, compensation for damages may be claimed, and depending on the nature of the damage, a large amount of compensation may be required.
In addition, it is necessary to investigate the cause of the security problem and introduce remedial measures, which incurs financial and human costs.
The cost of dealing with damage caused by security risks cannot be ignored, and depending on the cost, management may be under pressure.
How to secure Contact Form 7
Here are some ways to make Contact Form 7 more secure:
- Update WordPress and plugins
- Installed plug-in “Honeypot for Contact Form 7”
- Installed the plug-in ” Google reCAPTCHA”
- Installed the plug-in “Akismet”
- convert to SSL
- Setting access rights
Update WordPress and plugins
Keep your plugins and WordPress up-to-date to improve the security of forms created with Contact Form 7. If you continue to use the old version, the vulnerability will be left unattended and the risk of being attacked such as unauthorized access will increase.
If you receive a notification of an update to WordPress or a plugin, act quickly. In some cases, notifications may not be sent, so we recommend that you check the latest information published on the official website.
Installed plug-in “Honeypot for Contact Form 7”
If you want to increase the security of Contact Form 7, you can also install “Honeypot for Contact Form 7”. “Honeypot for Contact Form 7” is a plug-in that can prevent spam emails and unauthorized access.
Many spam emails are automatically sent by an auto-fill program, so as a countermeasure, set an input item (hidden field) that is not displayed on the page, and if there is an input there, it will be judged as spam.
Installed the plug-in “Google reCAPTCHA”
” Google reCAPTCHA” is an authentication system for anti-spam provided by Google, and can be introduced by installing a plug-in.
Spam bots are determined by whether or not the checkbox on the page is checked or whether or not the image that meets the conditions is selected correctly.
However, if you install reCAPTCHA, it will take more time for users to check and select images, and it may cause stress, so be careful.
Installed the plug-in “Akismet”
kismet is a plug-in that automatically separates spam emails into a dedicated folder. Since there is no need to sort and delete spam emails manually, you can reduce the risk of information being leaked by accidentally clicking on a URL in spam emails.
In addition, it is a plugin that is installed in WordPress from the beginning and is recommended by the developer of WordPress as an anti- spam plugin, so it is more reliable than other security plugins.
You can use it for free for personal blogs, but be aware that you will be charged for using it on corporate and commercial sites.
convert to SSL
To protect the data sent from the form, use SSL for communication. “SSL” is a technology that encrypts communication data to prevent third parties from eavesdropping and falsifying communication contents.
The information entered by the user in the form is also encrypted before being sent, preventing information leakage.
The URLs of SSL-encrypted sites have “https” at the beginning, and since most sites use SSL, it is essential as a form of security measure.
Setting access rights
To make Contact Form 7 more secure, you should also set access permissions. If anyone can easily access it, there is a risk of unauthorized login to the management screen and falsification of forms and information.
In order to prepare for security risks, let’s properly set permissions such as administrators, editors, and viewers. However, setting access permissions in Contact Form 7 requires editing a file written in PHP, which is difficult without specialized knowledge.
If you want to easily set access permissions and security measures, there is a method of “Create a form with a tool that has perfect security measures “.
With “formrun” you can create forms with perfect security measures
If you want to create a form with perfect security measures, “formrun” is also recommended.
formrun is a tool that allows you to easily create a form in as little as 30 seconds and has various security measures as shown below.
- Acquired ISO 27001 (ISMS) and Privacy Mark
- Adoption of SSL/TLS
- Possible to install reCAPTCHA
- Monitor your servers 24/7
- Uses Amazon Web Services (AWS) data centers
The created form can be embedded in a site such as WordPress with a few clicks. It also has an input assistance function and a real-time validation function that reduce the trouble of respondents.
There is also a function to manage customer information sent from the form, and inquiries can be managed by status such as “not responding, responding, response completed” on the Kanban screen. If you want to streamline customer management as well as security measures, please try formrun.
Thorough security measures for Contact Form 7 and prevent damage before it happens
Contact Form 7 is attractive because you can easily set up an inquiry form, but you need to take thorough security measures when using it.
If security measures are not perfect, vulnerabilities will be exploited and attacked, resulting in the leakage of customer information, loss of credibility of the company, and cost to deal with the damage.
In order to take security measures with Contact Form 7, it is necessary to introduce another plug-in, which takes time and effort. If you want to easily create secure forms, formrun is also recommended.
formrun supports the adoption of SSL/TLS, the installation of reCAPTCHA, server monitoring 24 hours a day, 365 days a year, and it is also possible to set access permissions.
Not only can it be easily embedded in your WordPress site, but it is also free to use and has functions that streamline customer management, so please give it a try.
