> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://krystal-dev.crisp.help/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Securing forms in Joomla

Form spam is a common issue with websites - this is when either the site administrators email get sent spam via an attack on the sites contact forms. This can be compounded if your registration form is unprotected as an attacker can then register false accounts and then send spam to these that appears to come from your site.

There are a number of steps you can take to mitigate this risk and improve the security of your Joomla site.

1.  **Register for Google reCAPTCHA**  
    Your first port of call will be to follow our guide on [registering your site for Google reCAPTCHA - link opens in a new window](/article/rpb3pl4jnr-using-google-re-captcha-to-secure-forms-on-your-site). You'll need your Google reCAPTCHA Site and Secret keys to complete the following steps.
2.  **Replace any Joomla contact forms and disable the Contacts extension (com_contact)**  
    We suggest using a replacement for the in-built Joomla contact form and disabling the **com_contact** component. This can be found under the **Extensions > Manage > Manage**
    
    ![](https://storage.crisp.chat/users/helpdesk/website/d1d3b07c89e3b000/5c0b359a-9d3e-493e-a393-f66e06_1diuapp.jpeg)
    
    Search for **contacts** and click the green tick - it'll become a red cross to disable the Contacts extension.
    
    ![](https://storage.crisp.chat/users/helpdesk/website/80b0591451b60800/cd595078-2f14-4652-9956-70f914_qpgfq0.jpeg)
    
    Suggested replacements include RSForm Pro (paid), RSContact (free) or Breezing forms (free and paid versions) - these all integrate with Google reCAPTCHA to secure your contact and registration forms.
3.  **Switch from PHPMail to SMTP for sending emails**  
    Visit **System > Global Configuration**
    
    ![](https://storage.crisp.chat/users/helpdesk/website/6712797cb0553000/3fe5059a-35f5-4758-8a66-54c107_1trsg2v.jpeg)
    
    Select the **Server** Tab
    
    ![](https://storage.crisp.chat/users/helpdesk/website/1dd5af65b424ee00/f224dee6-f5a2-467b-afbf-1486cb_1alp3fj.jpeg)
    
    Select **SMTP** from the Mailer drop-down and configure the remaining settings. You can either use details for an existing mailbox or [create a new mailbox in cPanel](/email/adding-a-new-c-panel-email-account) for your site to use.
    
    ![](https://storage.crisp.chat/users/helpdesk/website/96a066913062a800/176e739e-812d-4f99-a6e0-981663_9huaph.jpeg)
    
4.  **Setup reCAPTCHA**  
    Visit **Extensions > Plugins** and search for **captcha**.
    
    ![](https://storage.crisp.chat/users/helpdesk/website/4550346122804000/a31b63ca-ad5a-4cdd-9986-718cd8_16xd0iy.jpeg)
    
    Enable the matching version on CAPTCHA to that which you configured within Google.  
    Once enabled click on the plugin name and enter the Site and Secret keys for your site from Google.
    
    ![](https://storage.crisp.chat/users/helpdesk/website/6131a912b4dc7800/ca3eceaf-59da-406d-ac4b-e53fa0_sn18fg.jpeg)
    
    Click **Save** to complete this step.
5.  **Enable reCAPTCHA for Joomla contact forms and disable user registration (if not required)**  
    Visit **System > Global Configuration**
    
    ![](https://files.helpdocs.io/8nzbvyta9f/articles/kguje5matl/1574336049925/joomla-3.jpg)
    
    Then select Users.
    
    ![](https://files.helpdocs.io/8nzbvyta9f/articles/kguje5matl/1574336077097/joomla-8.jpg)
    
    Set **Allow User Registration** to No  
    Set **Captcha** to the version you set up in step 4.  
    Click **Save** to complete this step.
6.  **Update Joomla, themes and all extensions to the latest version**  
    As with any CMS based website, we always suggest you keep up to date.  
    It can be useful to use the Softaculous ([Clone](/web-hosting/cloning-a-website-with-softaculous) or [Staging](/web-hosting/staging-a-website-with-softaculous)) to create a copy of your site on which you can test updates before rolling them out on your live site.  
    Please make sure you have reliable backups before making any changes to your live site - so you can roll-back should there be any issues.

* * *

* * *