« Return To List

What is Form Hijacking?

Form Hijacking is when an online form, such as a contact us form, is exploited to send out spam emails using the server that the form is on to send them. This can occur when an online form is not secure and can be used to send spam to anyone. When spammers do this, the spam looks like it originates from the online form rather than from the spammer. This can cause the server that the online form is hosted on to be blacklisted (blocked from sending mail to) by other email providers for sending spam. If your website is on a shared hosting server, the provider may end up shutting the site down until the form is fixed as it affects all of the other websites as well.

When an online form is submitted, a script built into the website is used that sends an email. Bots (software that runs automated tasks) search through the internet looking for online forms and test them to see if they are vulnerable. When it finds a form that it can corrupt fields such as the To: From: and Subject: fields, then the spammer is able to send an email with any subject and message to any email address, and it would be sent from the online form.

To prevent Form Hijacking the script used to send the email must be secure. There are a number of ways to do this but one of the best ways is to make sure the script checks the submitted characters and removes line breaks in the email headers. The script should also check for required fields and email validation. If using a commercially available script for an online form, it should be checked on a regular basis for any available security updates.

« Return To List

Newsletter Signup

Full Name:

Email Address: