PAP-475 CF7 anti-spam (honeypot + sender integrity)

‘;
$hp .= ‘Leave this field empty
‘;
$hp .= ‘

‘;
return $elements . $hp;
}, 20 );

/* —- 2) Spam validation: honeypot + blocked sender + header injection + bait —- */
add_filter( ‘wpcf7_spam’, function ( $spam, $submission = null ) {
if ( $spam ) { return $spam; }
if ( ! $submission || ! method_exists( $submission, ‘get_posted_data’ ) ) {
$submission = null;
if ( class_exists( ‘WPCF7_Submission’ ) ) { $submission = WPCF7_Submission::get_instance(); }
}
if ( ! $submission ) { return $spam; }

$data = $submission->get_posted_data();

// Honeypot tripped (only bots see/check the hidden box)
if ( ! empty( $data[‘ttc-hp’] ) ) { return true; }

// Blocked sender (PAP-475)
$blocked = array( ‘benjamin.clarke@jmailservice.com’ );
$email = isset( $data[‘your-email’] ) ? strtolower( trim( (string) $data[‘your-email’] ) ) : ”;
if ( in_array( $email, $blocked, true ) ) { return true; }

// Header-injection attempt in any text field
foreach ( array( ‘your-name’, ‘your-subject’, ‘your-message’ ) as $f ) {
$v = isset( $data[ $f ] ) ? (string) $data[ $f ] : ”;
if ( preg_match( ‘/(\r|\n|\bcc:|\bbcc:|Content-Type:)/i’, $v ) ) { return true; }
}

// Known spam bait subject
$subj = isset( $data[‘your-subject’] ) ? (string) $data[‘your-subject’] : ”;
if ( false !== stripos( $subj, ‘Get Found Fast’ ) ) { return true; }

return $spam;
}, 10, 2 );

/* —- 3) Mail integrity: never spoof From with visitor data —- */
add_filter( ‘wpcf7_mail_components’, function ( $components, $contact_form, $mail = null ) {
$site_domain = wp_parse_url( home_url(), PHP_URL_HOST );
$components[‘sender’] = ‘Top Travel Centre ‘;

$reply = ”;
if ( class_exists( ‘WPCF7_Submission’ ) ) {
$submission = WPCF7_Submission::get_instance();
if ( $submission ) {
$posted = $submission->get_posted_data();
$email = isset( $posted[‘your-email’] ) ? sanitize_email( $posted[‘your-email’] ) : ”;
if ( is_email( $email ) ) { $reply = $email; }
}
}
$components[‘additional_headers’] = $reply
? ‘Reply-To: ‘ . $reply
: ‘Reply-To: ‘ . get_option( ‘admin_email’ );

return $components;
}, 10, 3 );