Secure CGI Mail Form - How to Prevent Your Forms From Being Stolen
Recently a client of mine suddenly received a huge number of requests (approx. 5000) for a free sample he was offering from his web site. I had installed Master Form v4 which is an anti-hijacking form. I was surprised when I checked the admin section of Master Form to find several sites had stolen this secure cgi mail form by copying and pasting the form code from my client’s site to their own site.
The form was being used on several unauthorized domains so my client received lots of traffic to his site and a large number of illegitimate requests for his free product.
How to Prevent Your Mail Form From Being Used on Unauthorized Web Sites
1. Login to the Master Form administration panel and delete unauthorized form locations.
2. Turn the auto-submit protection on in the admin panel. Two things need to be done to make this happen:
a) Paste certain JavaScript into the authorized forms.
b) Check a certain checkbox in the Master Form V4 control panel.
This page provides step-by-step instructions for auto submit protection
This will only prevent automatic submission. If people fill out the forms manually and submit them, the software probably won’t detect that.
3. Another thing that can be done is to put Form location (if known): [[REFERRER]] into the email the client receives. That will provide the location of the form being used unless the browser suppresses the information. Those requests can then be ignored or sent an email with the official location of the form.
The software is designed so the site owner can put the Master forms on any and all domains he owns. So it doesn’t have restriction by domain.
How to Prevent Your Forms From Being Stolen
(if the person is copying and pasting the form on their own site)
I contacted the creator of Master Form (Will Bontrager) and he wrote a great article on how to use javascript to stop forms from being stolen. The article is titled Forms Copied And Pasted To Unauthorized Web Sites
Master Form V4 will be upgraded in the future to allow the site owner to specify the domains that can use the form.
