In Germany, it is mandatory to by law to use secure contact forms (secured by TLS for example) when you are a website owner. Is the Drupal 7 contact form secure in this regard?
1 Answer
No. No form, in any website, is inherently "secure" or encrypted. If your requirement is to serve and submit the form over TLS, you'll need to set that up on your server/host as a separate task.
Once you have, Drupal will happily serve any page over https, and submit forms in the same manner.
The only thing you might want to consider from a Drupal point of view is to un-comment the lines in the default .htaccess which force-upgrade all requests to https. If your server isn't Apache that'll have to be done elsewhere.
-
Your answer suggest to force all requests to use https – what about just forcing the contact form? Is there a possibilty? Dec 8, 2017 at 11:29
-
1Sort of, but it's pretty awkward. You can use drupal.org/project/securepages, but it hasn't been updated in a long time now. Given the current state of the internet full https is the way to go– Clive ♦Dec 8, 2017 at 11:38