Security
Spam, bots, injection, upload handling and the defaults that keep a public form from becoming a liability.
9 articles
-
Never Collect Card Numbers in a WordPress Authorization Form
A WordPress credit card authorization form should collect approval and job details, then hand payment data to Stripe or another payment provider.
Read → -
Hidden Fields in HTML Forms: Useful Data, Not Trusted Data
Learn safe uses for hidden fields in HTML forms, what attackers can change, and which values must be verified on the server.
Read → -
Webhook Signature Verification With HMAC-SHA256
Implement webhook signature verification with HMAC-SHA256, raw request bodies, timestamp checks, constant-time comparison, and secret rotation.
Read → -
How to Build a WordPress User Registration Form Safely
Build a WordPress user registration form with unique-email checks, least-privilege roles, secure password delivery, spam controls, and audit trails.
Read → -
Nulled Meaning: What Nulled Plugins Are and Why They're Risky
Nulled means a paid WordPress plugin or theme with license checks removed. Learn the GPL nuance, malware risk, update problem, and safer alternatives.
Read → -
What Is a Honeypot Field? Invisible Spam Protection, Explained
A honeypot field is a hidden input only bots fill in. Here's how it works, how to add one to any form, and where it fails — from 100+ client forms.
Read → -
File uploads on WordPress forms
File uploads are a paid add-on in most WordPress forms plugins. Here's why they shouldn't be, and the four things you need to get them right.
Read → -
Core Forms 4.2
WhatsApp three ways, a Contact Form 7 importer, a per-form analytics tab, revisions for forms, 14 security fixes and a WordPress-native admin. Released May 12, 2026, followed by ten patch releases through May 16 that added a star rating field, a columns container and five templates.
Read → -
Akismet isn't enough — what to layer
Akismet is the WordPress default for spam. But it's not a complete solution. Here's the four-layer setup I run on production sites.
Read →
Stop reading. Ship a form.
All these notes are from running Core Forms on real client sites. Use code
CFLAUNCH for 20% off either plan.