I have a page with a page template that receives data through the post method (data is processed in a payment gateway and the response is sent to wordpress) this data is processed in the template, creates an html document that is sent by email as the body of the message using the function wp_mail (), if a user performs the process, the email is generated and sent correctly, even with the attachments, a version comes to the user and another to the corresponding staff, the issue is that empty emails arrive every day staff and I wonder how to avoid this? This is how I send the mail

$subject = "Payment Options";
$headers = "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: text/html; charset=ISO-8859-1\r\n";
$headers .= "Return-Path: <[email protected]>"."\n";
$message = "builded HTML"; 

function ejr_email_desde ($email) {
    return "[email protected]";

add_filter ("wp_mail_from", "ejr_email_desde");

$attach = array('path to attached files');
$sent = wp_mail("[email protected]", $subject, $message,$headers, $attach);
wp_mail("[email protected]", $subject, $message,$headers, $attach);
wp_mail("[email protected]", $subject, $message,$headers, $attach);
wp_mail("[email protected]", $subject, $message,$headers, $attach);
wp_mail("[email protected]", $subject, $message,$headers, $attach);

$subject = "Subject";
$headers .= "MIME-Version: 1.0\r\n";
$headers .= "Content-Type: text/html; charset=ISO-8859-1\r\n";
$message = "The builded HTML"; 
$attachments = array('path to attachment');

wp_mail('client@email', $subject, $message,$headers,$attachments); 

this is the empty htmlenter image description here

When the user performs the process the fields are filled correctly, What I want is to avoid generating the email without data

  • You should process post forms using admin-post.php and use nonces in there - it should help. You could also use honeypot. Commented Aug 10, 2018 at 15:59

1 Answer 1


Do a quick check to make sure one of the required $_POST payment variables is present and not empty.

So at the top of your file

if(!empty($_POST['paymentinfovariable'])) {
    // put all your current code here
    // that way POST info is only processed, and email is only sent,
    // if your required variable has been properly POSTed.
} else {
// redirect to the homepage
    wp_redirect( home_url() );

This way if the required post variable is missing - meaning someone is just visiting the URL - they'll get redirected to the homepage and no email will be sent. You could go a step farther and check that a POSTed variable has the correct format, comes from the correct referring domain, etc. to further protect your security.

You should probably also look into your sitemaps - there's a reason people (or bots) are hitting this page, and it could be as simple as setting your sitemap to meta noindex with whatever SEO plugin you are using.

  • thankyou WebElaine, i apply both suggestions and perform a manual test, it seems that the problem is solved! Commented Aug 10, 2018 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.