Security Checklist

After installation

• Delete install.php.
• Keep config/config.php private.
• Use HTTPS.
• Use a unique administrator password.

Public forms

• Keep rate limiting enabled unless there is a reason not to.
• Use Turnstile for forms attracting automated abuse.
• Use Password protection for limited/private forms.
• Use embedding restrictions when forms should appear only on approved sites.

Integrations

• Prefer HTTPS webhook endpoints.
• Use a Signing secret where appropriate.
• Keep SMTP passwords private.

Privacy

• Store IP addresses only when needed.
• Store browser/user-agent data only when useful.
• Configure retention instead of keeping data forever when long-term storage is unnecessary.

Maintenance

• Keep PHP and server software maintained.
• Back up before updates.
• Test the application after hosting/PHP changes.