Secure PHP Contact Form: Complete Code and Instructions (2026)

<?php
declare(strict_types=1);

session_start([
    'cookie_httponly' => true,
    'cookie_secure'   => true,   // the page must load over HTTPS
    'cookie_samesite' => 'Lax',
    'use_strict_mode' => true,
]);

// One secret token per visitor session. send.php checks it (CSRF protection).
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
// When the form was shown. Bots that submit within seconds are ignored.
$_SESSION['form_shown_at'] = time();

// What the visitor typed, if send.php sent them back with an error.
$old = $_SESSION['old_input'] ?? [];
unset($_SESSION['old_input']);

$messages = [
    'invalid' => 'Please enter your name, a valid email address and a message of at least 10 characters.',
    'expired' => 'Your session expired. Please send the form again.',
    'limit'   => 'You have sent several messages recently. Please try again in an hour.',
    'send'    => 'Sorry, your message could not be sent. Please try again later or email us directly.',
];
$code  = $_GET['error'] ?? '';
$error = is_string($code) ? ($messages[$code] ?? null) : null;

function e(mixed $value): string
{
    return htmlspecialchars(is_string($value) ? $value : '', ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}

$topic = $old['topic'] ?? 'general';
?>
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Contact us</title>
  <style>
    .hp-field { position: absolute; left: -10000px; width: 1px; height: 1px; overflow: hidden; }
  </style>
</head>
<body>
  <h1>Contact us</h1>

  <?php if ($error !== null): ?>
    <p role="alert"><?= e($error) ?></p>
  <?php endif; ?>

  <form action="send.php" method="post">
    <input type="hidden" name="csrf_token" value="<?= e($_SESSION['csrf_token']) ?>">

    <p>
      <label for="name">Your name</label><br>
      <input type="text" id="name" name="name" required maxlength="100"
             autocomplete="name" value="<?= e($old['name'] ?? '') ?>">
    </p>
    <p>
      <label for="email">Your email</label><br>
      <input type="email" id="email" name="email" required maxlength="254"
             autocomplete="email" value="<?= e($old['email'] ?? '') ?>">
    </p>
    <p>
      <label for="topic">Topic</label><br>
      <select id="topic" name="topic">
        <option value="general" <?= $topic === 'general' ? 'selected' : '' ?>>General question</option>
        <option value="sales" <?= $topic === 'sales' ? 'selected' : '' ?>>Sales</option>
        <option value="support" <?= $topic === 'support' ? 'selected' : '' ?>>Technical support</option>
      </select>
    </p>
    <p>
      <label for="message">Message</label><br>
      <textarea id="message" name="message" rows="6" required minlength="10"
                maxlength="5000"><?= e($old['message'] ?? '') ?></textarea>
    </p>

    <!-- Honeypot: hidden from people, bots fill it in. -->
    <div class="hp-field" aria-hidden="true">
      <label for="website">Leave this field empty</label>
      <input type="text" id="website" name="website" tabindex="-1" autocomplete="off">
    </div>

    <p><button type="submit">Send message</button></p>
  </form>
</body>
</html>

<?php
declare(strict_types=1);

// ---------- Settings: change these ----------
const MAIL_TO     = '[email protected]';      // where enquiries are delivered
const MAIL_FROM   = '[email protected]';   // a real mailbox on YOUR domain
const FROM_NAME   = 'Your Business Website';
const FORM_PAGE   = '/contact.php';
const THANK_YOU   = '/thank-you.html';
const RATE_LIMIT  = 5;       // messages allowed per IP address...
const RATE_WINDOW = 3600;    // ...within this many seconds
const MIN_SECONDS = 3;       // a form sent faster than this is treated as a bot
const DATA_DIR    = __DIR__ . '/../contact-form-data';   // outside public_html
const TOPICS = [
    'general' => 'General question',
    'sales'   => 'Sales',
    'support' => 'Technical support',
];
date_default_timezone_set('Asia/Kolkata');
// ---------------------------------------------

session_start([
    'cookie_httponly' => true,
    'cookie_secure'   => true,
    'cookie_samesite' => 'Lax',
    'use_strict_mode' => true,
]);

function redirect(string $url): never
{
    header('Location: ' . $url, true, 303);
    exit;
}

function fail(string $code, array $input = []): never
{
    $_SESSION['old_input'] = $input;   // refill the form for the visitor
    redirect(FORM_PAGE . '?error=' . $code);
}

function field(string $key): string
{
    $value = $_POST[$key] ?? '';
    return is_string($value) ? trim($value) : '';
}

function rate_limited(string $ip): bool
{
    if (!is_dir(DATA_DIR) && !mkdir(DATA_DIR, 0700, true) && !is_dir(DATA_DIR)) {
        error_log('Contact form: cannot create ' . DATA_DIR);
        return false;   // never block real visitors because of a folder problem
    }
    $fp = fopen(DATA_DIR . '/' . hash('sha256', $ip) . '.json', 'c+');
    if ($fp === false) {
        return false;
    }
    flock($fp, LOCK_EX);
    $now  = time();
    $hits = json_decode((string) stream_get_contents($fp), true);
    $hits = array_filter(is_array($hits) ? $hits : [], fn($t) => is_int($t) && $t > $now - RATE_WINDOW);
    $limited = count($hits) >= RATE_LIMIT;
    if (!$limited) {
        $hits[] = $now;
        ftruncate($fp, 0);
        rewind($fp);
        fwrite($fp, json_encode(array_values($hits)));
    }
    flock($fp, LOCK_UN);
    fclose($fp);
    return $limited;
}

// 1. Accept POST only.
if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') {
    http_response_code(405);
    header('Allow: POST');
    exit('Method not allowed');
}

// 2. CSRF: the token must match the one given to this visitor's session.
$sessionToken = $_SESSION['csrf_token'] ?? null;
if (!is_string($sessionToken) || !hash_equals($sessionToken, field('csrf_token'))) {
    fail('expired');
}

// 3. Honeypot filled in, or sent too fast: a bot. Pretend it worked, send nothing.
$shownAt = $_SESSION['form_shown_at'] ?? 0;
if (field('website') !== '' || !is_int($shownAt) || time() - $shownAt < MIN_SECONDS) {
    redirect(THANK_YOU);
}

// 4. Validate every field on the server.
$name    = field('name');
$email   = field('email');
$topic   = field('topic');
$message = str_replace(["\r\n", "\r"], "\n", field('message'));
$input   = ['name' => $name, 'email' => $email, 'topic' => $topic, 'message' => $message];

$valid = mb_check_encoding($name . $email . $message, 'UTF-8')
    && $name !== '' && mb_strlen($name) <= 100
    && !preg_match('/[\x00-\x1F\x7F]/', $name . $email)       // blocks header injection
    && filter_var($email, FILTER_VALIDATE_EMAIL) !== false && strlen($email) <= 254
    && array_key_exists($topic, TOPICS)
    && mb_strlen($message) >= 10 && mb_strlen($message) <= 5000;

if (!$valid) {
    fail('invalid', $input);
}

// 5. Rate limit per IP address.
$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
if (rate_limited($ip)) {
    fail('limit', $input);
}

// 6. Build the email. From is YOUR mailbox; the visitor goes in Reply-To.
$subject = mb_encode_mimeheader('[Website] ' . TOPICS[$topic] . ' from ' . $name, 'UTF-8', 'B');

$body = "New message from your website contact form\n\n"
    . "Name:  {$name}\n"
    . "Email: {$email}\n"
    . 'Topic: ' . TOPICS[$topic] . "\n"
    . 'Sent:  ' . date('j M Y, H:i T') . "\n"
    . "IP:    {$ip}\n\n"
    . "Message:\n{$message}\n";

// Quoted-printable keeps long lines and non-English text intact.
// Encode with CRLF line ends, then hand sendmail plain LF line ends.
$body = str_replace("\r\n", "\n", quoted_printable_encode(str_replace("\n", "\r\n", $body)));

$headers = [
    'From'                      => mb_encode_mimeheader(FROM_NAME, 'UTF-8', 'Q') . ' <' . MAIL_FROM . '>',
    'Reply-To'                  => $email,
    'MIME-Version'              => '1.0',
    'Content-Type'              => 'text/plain; charset=UTF-8',
    'Content-Transfer-Encoding' => 'quoted-printable',
];

// 7. Send. The fifth parameter sets the envelope sender so SPF passes.
if (!mail(MAIL_TO, $subject, $body, $headers, '-f' . MAIL_FROM)) {
    error_log('Contact form: mail() returned false');
    fail('send', $input);
}

// 8. Success: issue a fresh token for any next message, then say thank you.
unset($_SESSION['csrf_token']);
redirect(THANK_YOU);

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta name="robots" content="noindex">
  <title>Thank you</title>
</head>
<body>
  <h1>Thank you, your message has been sent</h1>
  <p>We have received your message and will reply to the email address you gave us.</p>
  <p><a href="/">Back to the home page</a></p>
</body>
</html>