Building my own contact form in Wordpress. Any there any security steps I need to consider other than the typical email etc validation and maybe a captcha. I am not sending any data to the database.
Even though you're not sending anything to the database, I'd suggest using some of the built in data validation functions (there is even a
is_email function for you to use!) to strip out any HTML from your email.
esc_html( striptags( $your_email_content ) ), for instance.
You could also throttle contact form submissions from a single IP to prevent someone from submitting the same thing many times. I don't know of any contact form plugins that do that, but the WordPress comment system show you an error page if you submit too many comments within a certain period of time.