Contact Form X vs Host Header Injection Fix

Displays a user-friendly contact form that your visitors will love. CFX: Contact form reinvented. Fast and friendly. Fresh and clean. Awesome for everyone 🙂 Overview Install, activate, and then display the form anywhere, using the widget, shortcode, or template tag. Here is an overview of Contact Form X: Easy to use Simple and secure ADA and WCAG compliant Lightweight and super fast Provides multiple form styles Customize just about everything Display the contact form anywhere Add Checkbox, Radio, and Select fields Customize the order of all form fields Send email to multiple recipients Complete documentation via Help tab Excellent free plugin support 😎 “The famous spam filter SpamAssassin” scores CFX = zero spam! For more details, check out the “Screenshots” section, below. Form Fields Easily choose which fields to display in the form. Each field may be set as required, optional, or disabled. Choose from these fields: Name Website Email Subject Custom Field 1 (can be dropdown, checkbox, radio, text, or phone number) Custom Field 2 (can be dropdown, checkbox, radio, text, or phone number) Custom Field 3 (can be dropdown, checkbox, radio, text, or phone number) Challenge Question Message Google reCaptcha (v2 or v3 Invisible) Cloudflare Turnstile (Invisible Captcha) Carbon Copy Agree to Terms You can change the order of these fields and customize their labels and placeholders, everything is super flexible. For a live demo of Contact Form X, visit my support page at Plugin Planet, and also my contact page at Perishable Press. Feel free to send a test email to see how it works, I won’t mind 😉 Also check out CFX in the “Screenshots” section (below) for a better idea of how the default form is styled out of the box. Geeky Stuff Lots of goodness for the geeks among us: Built with WordPress APIs Ajax-powered form submission Remembers all form data on error Cloudflare Turnstile (Invisible Captcha) Google reCaptcha (v2 or v3 Invisible) Drag/drop ordering of all form fields View your email messages on the WP Dashboard Option to enable/disable storing of email data in database Display form via widget, shortcode, or template tag Five CSS themes: Default, Classic, Micro, Synthetic, Dark Optionally disable all plugin styles and use your own CSS Optionally collect user data like IP, host, and referrer Works perfectly with or without Gutenberg Block Editor Focused on performance, security, and usability Include extra form and user info with each message Customize the form’s success and error messages Provides plenty of useful hooks for developers Targeted loading of CSS and JavaScript assets One-click remove email data from database One-click restore default options Translation ready Contact Form X is a fresh new, lighter alternative to the heavier contact forms out there. CFX is lightweight yet fully featured. As they say, “everything you want, nothing you don’t”. Privacy To help protect user privacy, Contact Form X provides the following features: Agree to terms checkbox, customizable Choose which fields to include with the form Option to disable collection of user IP address and other data Note: this plugin uses cookies to enhance form functionality Basically, this plugin enables visitors to send a message via contact form. Any information the user enters into the form will be sent directly to the recipient(s) according to plugin settings. When enabled in the plugin settings, details about each sent message will be stored in the WordPress database. Visit the “Advanced” plugin settings to control and/or disable this and other data-collection features. Note: CFX provides an option to enable Google reCaptcha, which is provided by Google as a third-party service. For details on privacy and more, please refer to official documentation for Google reCaptcha. Contact Form X is developed and maintained by Jeff Starr, 15-year WordPress developer and book author. Support development I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books: The Tao of WordPress Digging into WordPress .htaccess made easy WordPress Themes In Depth Wizard’s SQL Recipes for WordPress And/or purchase one of my premium WordPress plugins: BBQ Pro – Blazing fast WordPress firewall Blackhole Pro – Automatically block bad bots Banhammer Pro – Monitor traffic and ban the bad guys GA Google Analytics Pro – Connect WordPress to Google Analytics Head Meta Pro – Ultimate Meta Tags for WordPress REST Pro Tools – Awesome tools for managing the WP REST API Simple Ajax Chat Pro – Unlimited chat rooms USP Pro – Unlimited front-end forms Links, tweets and likes also appreciated. Thanks! 🙂

👉 Enables custom headers for WP email notifications 👉 Also provides a “set it and forget it” security fix for WP < 5.5 👉 Uses only 50KB of code, so super lightweight, fast, and effective Important As of WordPress 5.5, this plugin no longer is necessary to fix the host-header security issue reported in Ticket #25239 finally is fixed, and mentioned in this post WordPress 5.5 Beta 4. Thank You WordPress devs! Is this plugin still useful? Yes, it enables you to choose the “From”, “Name”, and “Return-Path” headers for all WP notification emails. And for versions of WordPress less than 5.5, this plugin continues to fix the host-header injection security issue. Features This simple plugin does three things: Sets custom From, Name, and Return-Path for WP notifications Fixes a security vulnerability in WordPress versions < 5.5 Fixes a bug where invalid email addresses may be generated (in WordPress versions < 5.5) Choose from the following options: Use WordPress defaults (insecure for WP < 5.5) Use “Email Address” from WP General Settings Use a custom name and address Plus there is an option to use the specified From address as the Return-Path header. Why? The security issue fixed by this plugin has been known about since way back in WordPress version 2.3. There has been some talk about fixing, but nothing has been implemented. While the issue does not affect all sites, it does affect a good percentage of them, including some of my own projects. So, not wanting to get hacked, I decided to write my own solution. Hopefully this issue gets fixed in a future version of WordPress, and this plugin will become unnecessary. As a bonus, setting an explicit From address resolves a long-standing bug whereby an invalid email address is generated under the following conditions: A “From” address is not set, And the $_SERVER['SERVER_NAME'] is empty So by explicitly setting a “From” address, we prevent this bug from happening. Security Issue What is the security issue addressed by this plugin? Follows is a quick summary. To learn more in-depth, check out the resources linked in the next section. WP uses $_SERVER['SERVER_NAME'] to set the “From” header in email notifications This includes sensitive email notifications like password resets and user registration In some cases, an attacker could modify the “From” header and intercept the email Using the intercepted email, an attacker could gain access to your site and wreak havoc More Infos This security vulnerability is well-known and has been around for a looong time. To learn more, check out these articles: WP Core Trac Ticket Exploit Box Info Exploit Database Privacy This plugin does not collect or store any user data. It does not set any cookies, and it does not connect to any third-party locations. Thus, this plugin does not affect user privacy in any way. Host Header Injection Fix is developed and maintained by Jeff Starr, 15-year WordPress developer and book author. Support development I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books: The Tao of WordPress Digging into WordPress .htaccess made easy WordPress Themes In Depth Wizard’s SQL Recipes for WordPress And/or purchase one of my premium WordPress plugins: BBQ Pro – Blazing fast WordPress firewall Blackhole Pro – Automatically block bad bots Banhammer Pro – Monitor traffic and ban the bad guys GA Google Analytics Pro – Connect WordPress to Google Analytics Head Meta Pro – Ultimate Meta Tags for WordPress REST Pro Tools – Awesome tools for managing the WP REST API Simple Ajax Chat Pro – Unlimited chat rooms USP Pro – Unlimited front-end forms Links, tweets and likes also appreciated. Thank you! 🙂