Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their subdomains. The asked my client to protect Contact Form 7 from malicious scripts or take it down.

When I asked for an example of what they tested, my client informed me that they run tests to see if a script could be inserted into a input (ie: <script>alert('hello');</script>) field or as a url string (ie: www.mydomain.com/contact?<script>alert('hello');</script>).

With the query string, the contact form sets the action to: action="/?scriptalert('hello');/script#wpcf7-f1-p6-o1"

Is there anything I can add to remove the possibility of running scripts in Contact Form 7?

share|improve this question
    
Try a plugin called Akismet. You can integrate it in contact form 7. Works, great, one of the best out there. –  Saif Bechan Aug 21 '11 at 15:34
add comment

2 Answers

Try this one instead http://wordpress.org/extend/plugins/si-contact-form/

The safest thing to do is just have no contact form and a plain old email link.

share|improve this answer
add comment

There is nothing to worry about here. By doing the above you can see the output is changed to something that is safe and is not going to cause any danger to the user or your server. If you IT team think that's something to worry about then they shouldn't be dealing with security aspect of the site.

Your best defence against website hacking is making sure your WordPress installation is the most up to date as possible and as soon as a plugin update is out, upgrade to it. Also make sure you have regular backups.

There is also a tonne of plugins out there that harden WordPress http://wordpress.org/extend/plugins/search.php?q=security&sort= if you feel the need to go that one step further.

share|improve this answer
    
As Brady states, Contact Form 7 doesn't run scripts currently. You may just need to create a rule of some sort, such that any action that contains a pattern matching /script/ redirects to a 403 forbidden status message to 'pass' their test. You need to find out what result they expect as the proper result when they test a 'protected' form. –  marfarma Jul 19 '11 at 7:07
    
re-upvoted this one again. Don't understand why it was downvoted. –  kaiser Apr 19 '12 at 21:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.