Securing Contact Form 7

Question

I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their subdomains. The asked my client to protect Contact Form 7 from malicious scripts or take it down.

When I asked for an example of what they tested, my client informed me that they run tests to see if a script could be inserted into a input (ie: <script>alert('hello');</script>) field or as a url string (ie: www.mydomain.com/contact?<script>alert('hello');</script>).

With the query string, the contact form sets the action to: action="/?scriptalert('hello');/script#wpcf7-f1-p6-o1"

Is there anything I can add to remove the possibility of running scripts in Contact Form 7?

Answer 1

Try this one instead http://wordpress.org/extend/plugins/si-contact-form/

The safest thing to do is just have no contact form and a plain old email link.

Answer 2

There is nothing to worry about here. By doing the above you can see the output is changed to something that is safe and is not going to cause any danger to the user or your server. If you IT team think that's something to worry about then they shouldn't be dealing with security aspect of the site.

Your best defence against website hacking is making sure your WordPress installation is the most up to date as possible and as soon as a plugin update is out, upgrade to it. Also make sure you have regular backups.

There is also a tonne of plugins out there that harden WordPress http://wordpress.org/extend/plugins/search.php?q=security&sort= if you feel the need to go that one step further.

Answer 3

I noticed this plugin will eval scripts returned to it from the server. This is a pretty poor design; I'd audit it quite carefully and remove functionality if I were you.