Contact Form (contact-form)

Summary

Discovers the contact page and form, analyzes fields, checks spam protection, and validates HTTPS (Playwright).

Classification

• Category: ECOMMERCE
• Plugin id: contact-form
• Version: 1.0.0
• Target types: WEBSHOP
• Weight class: MEDIUM
• Risk level: not set on plugin object
• Browser required: Yes (Playwright)
• Tier / group: Tier 3 — E-commerce / flows (Playwright)

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 3 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
contactUrl	Zod field in inputSchema — see source for defaults, min/max, and .describe().
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().
stepTimeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• _secrets — rarely used; primarily public form analysis.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for contact-form.

Check	Typical severity	Why
Contact page not found (/contact, /kontakt, nav link discovery)	WARNING	Customers cannot reach support — increases churn and support load on other channels.
Contact form missing essentials (email and/or message field, or submit)	WARNING	Incomplete forms block inquiries and look abandoned.
Form inputs missing accessible labels	WARNING	Inaccessible contact forms exclude users with disabilities and violate WCAG.
Empty submit lacks client-side validation	INFO	Empty submissions may spam backends or confuse users when server accepts blank data.
Contact page served over HTTP	WARNING	Form data (PII) sent in cleartext — privacy and compliance risk (severity below login’s CRITICAL policy).
No visible spam protection (reCAPTCHA, hCaptcha, Turnstile, honeypot, CSRF)	INFO	Unprotected forms attract bot spam and abuse.
No phone or email visible on page (regex + schema heuristics)	INFO	Users need alternate contact paths when forms fail or for urgent issues.
JavaScript errors on contact page	WARNING	Broken JS may prevent submit handlers and CAPTCHA from loading.

How each check works

1. Discover contact URL — contactUrl override or findContactPageUrl.
2. Form analysis — findContactForm detects name, email, message, phone, subject, submit; WARNING if email or message missing.
3. Accessibility — Flags form controls without label/aria-labelledby/aria-label.
4. Empty submit — Clicks submit, waits 2s; passes if :invalid, error classes, or Norwegian/English required-field text detected.
5. HTTPS — WARNING (not CRITICAL) if page URL is HTTP.
6. Spam protection — Detects reCAPTCHA/hCaptcha/Turnstile iframes, honeypot hidden fields, CSRF hidden inputs.
7. Contact info — Regex for phone/email plus itemprop="address" / map iframe heuristics.
8. Score and status — Step pass rate. Status warning if any WARNING; no CRITICAL findings.

Caveats and concerns

• Does not submit real messages — Empty submit only; no filled test inquiry sent.
• Multi-form pages — Analyzes first contact-like form found by DOM finder.
• Spam detection gaps — Server-side-only protection (rate limits) not visible to the test.
• HTTP vs login — Contact over HTTP is WARNING here vs CRITICAL on login-flow (different severity policy).
• Target type WEBSHOP — Plugin is webshop-scoped but contact pages exist on corporate sites too.

Source

packages/test-plugins/src/plugins/contact-form.ts