Contact Form System — Overview
Architecture
The contact form is rendered by the [opshell_contact_form] shortcode on WordPress page 9462. The PHP lives in WPCodeBox2 snippet 1, Opshell Contact Form Shortcode, running at custom_root. It handles rendering, request validation, CSV storage, and notifications.
The page is intentionally general-purpose: it welcomes questions, projects, server help, and consulting requests. The supporting content asks visitors to share their context and desired outcome so the next step can be recommended without assuming a specific service.
Data Flow
Security Layers
| Layer | Type | Purpose |
|---|---|---|
| Honeypot | Hidden field | Catches automated bots |
| Turnstile | Cloudflare bot check | Prevents scripted submissions |
| Reoon | Email verification | Validates deliverable email |
| Nonce | WordPress | CSRF protection |
| Input sanitization | PHP functions | Prevents XSS and injection |
Storage
- Successful submissions:
/opshell-contact-submissions/messages.csv - Failed verifications:
/opshell-contact-submissions/failed-verifications.csv - Directory created at
dirname(ABSPATH, 2) . "/opshell-contact-submissions" - Index.php added to prevent directory listing
Notification Channels
- Zammad Integration — helpdesk ticket created via REST API for verified submissions (stack on GSM16)
- Email Notifications — WordPress email notification for verified submissions
- Telegram Notifications — Bot API message to configured chat