I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their subdomains. The asked my client to protect Contact Form 7 from malicious scripts or take it down.

When I asked for an example of what they tested, my client informed me that they run tests to see if a script could be inserted into a input (ie: <script>alert('hello');</script>) field or as a url string (ie: www.mydomain.com/contact?<script>alert('hello');</script>).

With the query string, the contact form sets the action to: action="/?scriptalert('hello');/script#wpcf7-f1-p6-o1"

Is there anything I can add to remove the possibility of running scripts in Contact Form 7?

closed as off-topic by Pieter Goosen, Johannes Pille, fuxia Jul 23 '14 at 17:13

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • Try a plugin called Akismet. You can integrate it in contact form 7. Works, great, one of the best out there. – Saif Bechan Aug 21 '11 at 15:34

Try this one instead http://wordpress.org/extend/plugins/si-contact-form/

The safest thing to do is just have no contact form and a plain old email link.


There is nothing to worry about here. By doing the above you can see the output is changed to something that is safe and is not going to cause any danger to the user or your server. If you IT team think that's something to worry about then they shouldn't be dealing with security aspect of the site.

Your best defence against website hacking is making sure your WordPress installation is the most up to date as possible and as soon as a plugin update is out, upgrade to it. Also make sure you have regular backups.

There is also a tonne of plugins out there that harden WordPress http://wordpress.org/extend/plugins/search.php?q=security&sort= if you feel the need to go that one step further.

  • As Brady states, Contact Form 7 doesn't run scripts currently. You may just need to create a rule of some sort, such that any action that contains a pattern matching /script/ redirects to a 403 forbidden status message to 'pass' their test. You need to find out what result they expect as the proper result when they test a 'protected' form. – marfarma Jul 19 '11 at 7:07
  • re-upvoted this one again. Don't understand why it was downvoted. – kaiser Apr 19 '12 at 21:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.