Contact Form System — Overview
Architecture
The contact form is a custom PHP implementation managed via WPCodeBox2 snippet (ID 1: "Opshell Contact Form Shortcode"). It handles the full lifecycle: form rendering, spam prevention, email verification, data storage, and notification (Zammad ticket + email + Telegram).
Data Flow
Security Layers
| Layer | Type | Purpose |
|---|---|---|
| Honeypot | Hidden field | Catches automated bots |
| Turnstile | Cloudflare CAPTCHA | Prevents scripted submissions |
| Reoon | Email verification | Validates deliverable email |
| Nonce | WordPress | CSRF protection |
| Input sanitization | PHP functions | Prevents XSS and injection |
Storage
- Successful submissions:
/opshell-contact-submissions/messages.csv - Failed verifications:
/opshell-contact-submissions/failed-verifications.csv - Directory created at
dirname(ABSPATH, 2) . "/opshell-contact-submissions" - Index.php added to prevent directory listing
Notification Channels
- Zammad Integration — helpdesk ticket created via REST API for verified submissions (stack on GSM16)
- Email Notifications — SMTP email to site owner (default
donnyaw@gmail.com) - Telegram Notifications — Bot API message to configured chat