Security

Security is treated as a first-class requirement in ChargeForms, not an afterthought. This page summarizes the practices behind both our own infrastructure and the plugin code that runs on your site.

1. Server-authoritative validation

Every rule that matters — conditional field visibility, payment amounts, required-field checks, form restrictions — is re-verified server-side at submission time. Client-side state (a hidden field, a JS-computed total) is never trusted as the final word.

2. Payments

Payment amounts are always recalculated server-side from a form's own configuration, never trusted from the client. Every PaymentIntent is verified against Stripe's own API before an entry is created, with anti-replay protection against reusing a captured payment on a second entry or a different form.

3. File uploads

Uploads are validated via WordPress's own wp_handle_upload(real MIME checking, not just extension matching), plus a hard denylist of executable file types regardless of a form's own configured allowlist.

4. Export safety

CSV exports are hardened against formula/CSV injection — a submitted value starting with =, +, -, or @ is neutralized before being written to the export file, so it can never execute as a spreadsheet formula.

5. Spam protection

reCAPTCHA v2, hCaptcha, and Cloudflare Turnstile are all verified server-side against the provider's own API — a forged client-side token is rejected.

6. Reporting a vulnerability

Found a security issue? Please report it responsibly via Contact rather than a public issue tracker. We aim to acknowledge reports within 48 hours.