In Germany, it is mandatory to by law to use secure contact forms (secured by TLS for example) when you are a website owner. Is the Drupal 7 contact form secure in this regard?

1 Answer 1


No. No form, in any website, is inherently "secure" or encrypted. If your requirement is to serve and submit the form over TLS, you'll need to set that up on your server/host as a separate task.

Once you have, Drupal will happily serve any page over https, and submit forms in the same manner.

The only thing you might want to consider from a Drupal point of view is to un-comment the lines in the default .htaccess which force-upgrade all requests to https. If your server isn't Apache that'll have to be done elsewhere.

  • Your answer suggest to force all requests to use https – what about just forcing the contact form? Is there a possibilty?
    – Madam Adam
    Commented Dec 8, 2017 at 11:29
  • 1
    Sort of, but it's pretty awkward. You can use drupal.org/project/securepages, but it hasn't been updated in a long time now. Given the current state of the internet full https is the way to go
    – Clive
    Commented Dec 8, 2017 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.