I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to
We have been receiving a lot of spam, it seems that someone can handcraft the form and use it to send spam. In the processing script I check the
HTTP_SERVER to see if the request came in via our site, but those headers can also be manually crafted in. What steps do I need to undertake to stop the spam coming in?
Help is appreciated.
EDIT : Some more clarity. CF7 will POST the form data to my script at http://www.example.com/wp-content/themes/themename/script.php , that script is accessible . Someone can go to the page where my form is and copy the HTML, re-create the form on their local machine and start submitting the form to my script. How do I stop that?