I am building a contact form which calls a post controller and emails some of the posted values to a specified recipient.

My question Is How can I'secure' this form other than CAPTCHA? I looked at the Magento Contact form and that doesn't seem to have any mechanisms to stop someone simply calling the POST method and spamming the site.

Obviously I am checking/sanitizing inputs, but it seems like I should be at least incorporating a nonce or some kind of barrier.

Is there a 'best practice' in Magento?

1 Answer 1


As far as I know, Magento uses form_key to preventing against Cross Site Request Forgery. So you should use that first before the CAPTCHA option.

Reference post: Magento 2 - What is the use of formkey

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.