WP Manifestindependent plugin directory
manifest / forms / nethttp.net-contact

nethttp.net-contact WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

A custom contact form plugin for WordPress.

★ 1stars
v1.3.4latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/yrbane/nethttp.net-contact/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Custom Contact Form Plugin for WordPress

A custom contact form plugin for WordPress that allows you to easily create and manage contact forms on your website.

Features

  • Easily create and manage contact forms.
  • Automatically blocks submissions from blacklisted countries.
  • Secure form submissions to prevent spam and xss.
  • If submissions are not valid, ips are banned and cannot resubmit contact form.
  • Banned reason is stored in database.
  • Ips who are sending from same email or sending same message as another banned ip are also banned.
  • Supports multiple recipient email addresses.
  • Localisation.
  • Custom css.
  • Support for Google captcha reCAPTCHA.

Todo

  • Customize form fields and labels.
  • Manage banned Ip
  • ???

Installation

  1. Download the plugin ZIP file from the latest release.
  2. Upload and activate the plugin through the WordPress admin panel.

Usage

  1. Once the plugin is activated, you can use the [custom_contact_form] shortcode to embed a contact form on your posts or pages.
  2. Configure the plugin settings by going to the "Contact Form" section in the WordPress admin menu.

Configuration

  • Destination Email(s): Enter the email address(es) where contact form submissions should be sent. Separate multiple addresses with commas.
  • Blacklisted Countries: Enter a comma-separated list of country codes to block submissions from those countries.
  • reCAPTCHA Settings: Enter site key and secret key generated at Google reCAPTCHA.
  • Custom CSS: Enter your custom CSS.

License

This plugin is licensed under the GNU General Public License v3.0.

Changelog

See CHANGELOG.md for a list of changes and updates to the plugin.

Contributing

Contributions are welcome! If you find a bug or have an idea for a new feature, please open an issue or create a pull request.

Author

Support

For support and inquiries, please contact the author at the provided email address.

Acknowledgments

  • This is my first Wordpress extension.
  • Special thanks to the WordPress community for their support and inspiration.

Releases

3 releases.

Tag
Published
v1.3.4 latest
Nov 24, 2023 2 years ago
Sep 30, 2023 3 years ago
Sep 29, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

nethttp.net-contact 1.3.3 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.3.3
Findings
1
Worst severity
high
Content hash
9c787266bacaa0733bee1fe2…

Findings

  • high Failed contact submissions append deny-from rules to site .htaccess using REMOTE_ADDR

    dos

    is_valid_submission() calls ban_ip() on any failed validation (bad nonce/token/origin). ban_ip() appends 'deny from {REMOTE_ADDR}' to ABSPATH/.htaccess on Apache. A cross-site POST (CSRF) from a victim browser without a valid nonce bans that victim's IP from the entire WordPress site — unauthenticated DoS via .htaccess.

    nethttp.net-contact.php:1000-1052

    Recommendation

    Do not write .htaccess from unauthenticated form failures; rate-limit in DB only; validate IP format strictly; never ban based solely on failed CSRF/nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.