![\"Secure](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/10\/FEATURED-Secure-WordPress-Forms-Best-Practices-to-Keep-Your-Websit.jpeg\")
<\/p>\n<\/p>\n
Secure WordPress forms are an important part of any lead generation strategy. If people are going to submit data and\/or files to your site, you must take security seriously (for your sake and your users\u2019).<\/p>\n
<\/p>\n
Hackers and spammers use your forms to seek vulnerabilities in your website and force it to behave inappropriately.<\/p>\n
They might use it as a mail server to send spam messages or infect other websites. They could also create hidden pages and blog comments with links to other sites, or simply break your website code entirely.<\/p>\n
Hackers don\u2019t just make your website and brand look unprofessional. They can also damage your Google search rankings, break your site\u2019s functionality, and even get you caught up in legal trouble (depending on what the hacker does with your site).<\/p>\n
While a WordPress form builder like Gravity Forms<\/a> comes with some built-in security features, it\u2019s still your job to secure your forms.<\/p>\n In this post, we\u2019d like to go over some best practices to secure yours.<\/p>\n [content_upgrade cu_id=\"12865\"]Free download: 13 Step Action Plan if You Think Your Website was Hacked[content_upgrade_button]Click Here[\/content_upgrade_button][\/content_upgrade]<\/p>\n A simple way to secure WordPress forms is to enable double opt-in confirmation<\/a> on your email list.<\/p>\n With a double-opt in, people who complete your forms receive an email with a link to confirm their subscription. They have to click that link in order to get their email address on to the list and receive whatever the form promised (like a lead magnet, product demonstration, etc.).<\/p>\n If the subscriber doesn\u2019t click the verification link, they aren\u2019t added to the email list and don\u2019t receive your offering.<\/p>\n Most email marketing tools give you the option to set your forms to double opt-in. In fact, many prefer you use double opt-in because the extra step keeps people off email lists if they don\u2019t really want to be there.<\/p>\n Image: ometria.com<\/a><\/p><\/div>\n How do double opt-ins secure WordPress forms?<\/p>\n For one, they prevent people from putting someone else\u2019s email address on your list.<\/p>\n If a person throws their friend\u2019s email into your form with a single opt-in, their friend will get your messages and eventually mark you as spam. This affects your sending reputation<\/a> and email deliverability<\/a>.<\/p>\n If too many people mark you as spam, your email marketing service could kick you off. In worst cases, internet service providers could ban your domain.<\/p>\n Another reason to enable double opt-in on your email list is to avoid collecting non-existent email addresses.<\/p>\n In some cases, a person may throw a fake email address in your form just to get to the next page. Perhaps they want your free item without hearing from you again, or maybe they want you contact them some other way.<\/p>\n But if you put a dummy email address into your email marketing tool, they\u2019ll charge you for it even though it can\u2019t receive emails.<\/p>\n If you operate in the European Union (or abide by their standards because they\u2019re higher), you have to comply with the GDPR<\/a>. Double opt-ins are an important part of that.<\/p>\n One of the ways hackers gain access to your website is by injecting code into your form fields.<\/p>\n Your website code is written in a precise order. Form fields are opportunities for users to input their own data into that code to complete the sequence.<\/p>\n A password, for instance, is a chance for the user to enter the correct word that completes the code and unlocks the website.<\/p>\n But if a hacker wrote their own code and submitted through a form field, they could potentially add their own \u201clanguage\u201d to the sequence and force your website to behave in malicious ways.<\/p>\n So it\u2019s important to prevent users from entering anything they like into your form fields. They should only be able to input the kinds of data that relate to that field\u2019s purpose.<\/p>\n This is called input validation<\/a> and it\u2019s an important part of website security.<\/p>\n For instance, if you have a field that asks users to submit their zip code, you should limit that field to six characters and only numbers. There\u2019s no reason to accept any other types of data because if it\u2019s not six numbers, it\u2019s not a zip code.<\/p>\n In Gravity Forms, you can apply rules to fields that limit the type of data users can input.<\/p>\n This is especially important to password fields on login forms. If you ask for passwords to have at least one uppercase character and a special character, set those requirements for the field. These limitations make it very difficult for hackers to write code to inject into your site.<\/p>\n If you let people enter anything they like into your form fields, you risk hackers probing your site for vulnerabilities and eventually gaining access.<\/p>\n A lot of forms these days allow users to submit their own files. These are common on job application forms and credit card \/ banking forms, but they\u2019re useful for any site owner who needs unique information from their users.<\/p>\n But this feature is a prime opportunity for a hacker to upload something malicious that affects your website in unintended ways.<\/p>\n There are three ways to secure your file uploads:<\/p>\n 1. Force users to log in before submitting.<\/strong><\/p>\n If you don\u2019t get a lot of accounts, you may want to approve them all manually. If you don\u2019t want to bother with an approval process, use a reCAPTCHA to log in that automated bots can\u2019t pass.<\/p>\n 2. Limit the size of files that can be uploaded.<\/strong><\/p>\n This isn\u2019t a perfect solution because it\u2019s possible for a hacker to write a small file of malicious code, but it makes their job a lot harder because they need something unique to your site. They\u2019ll probably just try to hack someone else\u2019s website.<\/p>\n 3. Limit the types of files that can be uploaded.<\/strong><\/p>\n The most effective way to secure your file upload field is to limit the type of files people can upload. If you ask for a resume, for instance, limit the field to .DOC and. PDF files. This way a hacker can\u2019t submit unique files with malicious software.<\/p>\n How do you know whether the users who fill out your forms are real people behind actual computers\u2026 or automated bots programmed to break into websites?<\/p>\n Truthfully, you don\u2019t. To your website, all traffic looks the same.<\/p>\n So you need a way to test whether the user is a human being. That means asking them a question computers can\u2019t answer.<\/p>\n CAPTCHA is a security system designed to distinguish between computers and humans. It\u2019s an extra field that requires users to correctly type a few letters and numbers they see displayed on an image.<\/p>\n Since computers can\u2019t read images, they can\u2019t answer the field correctly.<\/p>\n CAPTCHAs are really effective<\/a>, but they come with a significant drawback: They\u2019re hard for users.<\/p>\n In one test, only 62% of participants<\/a> were able to successfully complete a CAPTCHA on their first try. 23% struggled multiple times before getting through. Extra form steps increase the likelihood of form abandonment<\/a>, so you want them to be as simple as possible.<\/p>\n In response to CAPTCHA\u2019s problems, Google launched reCAPTCHA<\/a>, a similar feature with an important improvement: All users have to do is check a box.<\/p>\n reCAPTCHA works by hiding the checkbox inside a special type of code that most bots don\u2019t see. Therefore they can\u2019t manipulate it.<\/p>\n With CAPTCHA or reCAPTCHA enabled, hackers have to manually visit your site on a computer in order to break in, rather than send their code all over the web automatically. That adds a lot of work, which means breaking into your site may not be worth it for them.<\/p>\n This is a general security tips that makes your site safer in a lot of ways, but helps secure WordPress forms too by protecting your users.<\/p>\n An SSL Certificate is a type of encryption that hides sensitive information as it passes between your site, your customers, and other parties.<\/p>\n The easiest place to get an SSL Certificate is your hosting provider. They usually offer a one-click package that adds the cost to your invoice. But you can also get one from places like DigiCert<\/a> or Namecheap<\/a>.<\/p>\n Once you have an SSL Certificate, the HTTP in your URL will change to HTTPS and you\u2019ll gain the little green padlock icon.<\/p>\n1. Set Your Forms to Double Opt-in<\/h2>\n
![\"Secure](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/10\/double-opt-in.png\")
2. Limit Your Field Inputs<\/h2>\n
![\"Secure](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/10\/input-validation.png\")
<\/p>\n3. Secure Your File Upload Features<\/h2>\n
![\"Secure](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/10\/secure-file-uploads.png\")
<\/p>\n4. Enable reCAPTCHA<\/h2>\n
![\"Secure](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/10\/captcha-field.png\")
<\/p>\n![\"Secure](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/10\/recaptcha.gif\")
<\/p>\n5. Install an SSL Certificate<\/h2>\n
![\"Secure](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/10\/ssl-certificate-icon.png\"){kind=icon}
<\/p>\n
![\"Secure](\"https:\/\/www.gravityforms.com\/wp-content\/uploads\/2018\/10\/globalsign-study.png\")
<\/p>\n