- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
Public forms can be abused for spam, account creation, email flooding, stored malicious content and resource exhaustion.
Security controls should reduce abuse while keeping the workflow accessible and private.
Validate Every Submission
Apply server-side validation even when JavaScript checks are present.
Confirm field formats, allowed values, size limits, authorization and business rules.
Rate Limits and Throttling
Limit repeated submissions by source, account or risk signal.
A contact form should not be usable to send unlimited email through the website.
Honeypots and Timing Checks
Hidden decoy fields and timing signals can identify simple bots with little user friction.
Implement them accessibly so assistive technologies do not present confusing required fields.
CAPTCHAs and Turnstiles
Challenges can reduce automation but introduce accessibility, privacy and external-service dependencies.
Use risk-based activation and provide a usable alternative.
Comments and Moderation
Configure approval rules, link limits, spam filtering and moderator notifications.
Do not publish untrusted HTML without the intended WordPress allowlist and escaping.
Registration Abuse
Protect public registration with:
- Least-privileged default roles.
- Email verification where appropriate.
- Rate limits.
- Duplicate detection.
- Clear deletion and privacy processes.
- Monitoring for mass account creation.
Email Injection and Flooding
Validate recipients and headers. Do not let arbitrary form values control mail headers or destination addresses.
Queue or rate-limit high-volume notifications.
Frequently Asked Questions
Is CAPTCHA required on every form?
No. Use layered controls appropriate to risk.
Does client-side validation secure a form?
No. Attackers can send requests directly to the server.
Continue Learning
Previous: [Preventing Brute-Force Attacks](/resources/wordpress-manual/security/preventing-brute-force-attacks/)
Next: [Security Logs and Monitoring](/resources/wordpress-manual/security/security-logs-monitoring/)