How do spammers abuse the Joomla 'Send Copy to Submitter' contact form setting?

Spammers submit the contact form with a target's email address and tick the copy checkbox, causing Joomla to forward the message to that address, making your site appear to be the spammer.

How does mySites.guru help with this spam risk?

The daily mySites.guru snapshot now detects whether 'Send Copy to Submitter' is enabled and alerts you, and the pivot view lets you see the setting's status across all connected sites at once.

Does disabling the global setting fully protect all my Joomla contact forms?

The global setting is the recommended default to disable, but individual contact forms can still override it - mySites.guru only checks the global value and assumes any per-form override is intentional.

Stop Joomla Contact Form Spam (2026)

We have all been there. The customer calls and says people are telling him that his Joomla Site is spamming them, and on investigation the spammer has misused the Send Copy To Submitter feature of Joomla. Well now mySites.guru identifies this setting and alerts you if its not disabled.

One of the long standing core features of Joomla is the Contact Form.

However, the contact form has been much abused by spammers over the years.

One of the ways spammers abuse the contact form is to use the Send Copy To Submitter feature.

This is a simple checkbox on the contact form that, when ticked, and the form submitted, will send the contact form as normal to the Site Admin (or whoever its configured to send to) as well as to the email address provided by the person filling in the form.

That “person” might be a bot, a spammer, and the email address they provide in the “Email” input is the email address destination of their spam target.

Once they put the email of their target in, and check the Send Copy To Submitterbox they submit the form and Joomla simply honours what they have asked. It sends a copy to the email address provided.

The “victim” then receives spam with a subject line starting “Copy of:”

The “victim” then accuses your site of spamming them. Of course, this only works if your site’s email configuration is actually sending mail in the first place - see how to verify your Joomla email configuration for the full checklist.

How Do You Disable Send to Submitter in Joomla?

Does the mySites.guru Snapshot Show This Setting?

Every day the mySites.guru snapshot takes tens of thousands of new snapshots of Joomla and WordPress sites (the Send Copy To Submitter issue is a Joomla thing though!)

ScreenShot 19.06.41

We now report in the snapshot if your site has the Send Copy To Submittersetting enabled.

ScreenShot 19.06.26

Note that in later versions this setting is disabled by default when you install Joomla, and that earlier versions had it enabled by default.

Note also that although we check the Global value of this setting, you can still override the Global setting on a per form basis. We don’t check this because that is a deliberate action you would need to take, and we hope you know why you did it. We are just recommending sane Global defaults.

You can also use the pivot button to view this settings current status on ALL your connected sites to mySites.guru (remember that mySites.guru is an UNLIMITED SITES service for only GBP19.99 a month!)

ScreenShot 19.07.33