PHP Settings

PHP Settings

The Canvas contact form posts to include/form.php, a self-contained PHP processor built on PHPMailer. You configure it by editing a few variables near the top of the file: the recipient, the From address, optional SMTP, and captcha secrets. This guide walks through each setting in the real file.

The Processor

include/form.php is powered by the bundled PHPMailer library. It receives the AJAX submission, validates it, sends the email, and replies to the form script as JSON. You never need to edit the processing logic itself, only the configuration variables near the top of the file, covered below.

Recipient Address

Set who receives the submissions. $toemails is an array, so you can add multiple recipients.

$toemails = array();

$toemails[] = array(
    'email' => 'your-email@website.com', // Your Email Address
    'name'  => 'Your Name'               // Your Name
);

To add a second recipient, push another entry:

$toemails[] = array(
    'email' => 'sales@website.com',
    'name'  => 'Sales Team'
);

From Address

The $fromemail is the address the mail is sent from. Use an address on your own domain so it passes SPF/DKIM checks.

$fromemail = array(
    'email' => 'no-reply@website.com', // Company's Email Address (preferably currently used Domain Name)
    'name'  => 'Company Name'          // Company Name
);

SMTP

By default PHPMailer sends through the server's mail() function. To send via SMTP, add your SMTP configuration inside the marked block:

$mail = new PHPMailer();

/* Add your SMTP Codes after this Line */

$mail->IsSMTP();
$mail->Host     = 'smtp.yourhost.com';
$mail->SMTPAuth = true;
$mail->Username = 'no-reply@website.com';
$mail->Password = 'your-smtp-password';
$mail->SMTPSecure = 'tls';
$mail->Port     = 587;

// End of SMTP

The auto-responder has its own separate PHPMailer instance with a matching block:

$autoresponder = new PHPMailer();

/* Add your Auto-Responder SMTP Codes after this Line */

// End of Auto-Responder SMTP

Add the same SMTP lines there if you want confirmation emails to go through SMTP too.

Captcha Secrets

If your forms use reCaptcha or hCaptcha, set the matching secret keys:

// Add this only if you use reCaptcha with your Contact Forms
$recaptcha_secret = ''; // Your reCaptcha Secret

// Add this only if you use hCaptcha with your Contact Forms
$hcaptcha_secret = ''; // Your hCaptcha Secret

To force a captcha on every submission (server-side, cannot be bypassed by removing the field), set:

// Set to true to require either reCaptcha or hCaptcha on every form submission.
$require_captcha = false;

Default Messages

The processor ships default success and error messages. A form can override any of them by submitting a message[...] field, otherwise these defaults apply:

$message = array(
    'success'          => 'We have <strong>successfully</strong> received your Message and will get Back to you as soon as possible.',
    'error'            => 'Email <strong>could not</strong> be sent due to some Unexpected Error. Please Try Again later.',
    'error_bot'        => 'Bot Detected! Form could not be processed! Please Try Again!',
    'error_unexpected' => 'An <strong>unexpected error</strong> occured. Please Try Again later.',
    'captcha_invalid'  => 'Captcha not Validated! Please Try Again!',
    'captcha_error'    => 'Captcha not Submitted! Please Try Again.'
);

Spam Protection

The processor blocks known spam keywords and limits how many URLs a submission may contain:

$spam_keywords = array(
    'viagra',
    'cialis',
    'levitra'
);

$allowed_urls = 1;

If a submission trips the spam filter, the processor returns a fake success so the spammer cannot tune keywords to get past it.

Options

Key variables you edit in include/form.php:

• $toemails = array of recipients (email, name).
• $fromemail = the From address (email, name).
• $recaptcha_secret / $hcaptcha_secret = captcha secret keys.
• $require_captcha = true to enforce a captcha server-side on every submit.
• $spam_keywords = blocked words array.
• $allowed_urls = max URLs allowed in a submission.
• $message = default response strings.

Tips

• Send from an address on your own domain ($fromemail) so mail is not flagged as spoofed.
• The reply-to on the mail is set from the form's replyto field, so replying in your inbox goes straight to the visitor.
• Server-side captcha enforcement ($require_captcha) cannot be bypassed by deleting the captcha widget from the client HTML.
• Uploaded files are attached automatically when the form has a file input and enctype="multipart/form-data".