FormMail in cPanel: use SMTP contact forms instead

FormMail.cgi is legacy. Old cPanel and WHMCS documentation referenced /cgi-sys/FormMail.cgi, a generic CGI-based form handler. While still available on some systems, it should NOT be your default choice for modern websites. Use authenticated SMTP with a maintained form plugin (WordPress) or mail library (PHP) instead for better security, reliability, and deliverability.

Why avoid legacy FormMail

FormMail.cgi has several disadvantages:

• No SMTP authentication: Uses unauthenticated PHP mail(), causing delivery failures and spam filtering
• Poor security: Form fields can be exploited for header injection and email spoofing attacks
• Unmaintained: The legacy FormMail code is not actively maintained; security vulnerabilities are unfixed
• Limited functionality: No file uploads, attachments, or advanced validation
• Outdated approach: Designed for 1990s websites; doesn't match modern web standards
• Spam delivery risk: Email may end up in spam without authentication headers (SPF, DKIM)

Better alternative: Use authenticated SMTP with a maintained form library or CMS plugin. Better deliverability, security, and flexibility.

Modern SMTP approach

For all modern contact forms, use authenticated SMTP instead of PHP mail():

Benefits of SMTP over PHP mail():

• ✓ Better deliverability (emails land in inbox, not spam)
• ✓ SPF/DKIM compatibility (authentication headers included)
• ✓ Encrypted password (not exposed in code)
• ✓ Better error handling and retry logic
• ✓ Works reliably across all hosting providers

WordPress contact forms

For WordPress, use a form plugin + SMTP plugin combo:

Popular form plugins:

• Contact Form 7: Simple, widely-used, free
• Fluent Forms: Modern UI, better features
• WPForms: Drag-and-drop builder, premium options
• Gravity Forms: Advanced logic, more powerful

Popular SMTP plugins:

• WP Mail SMTP: Most popular, works with Contact Form 7, Fluent Forms, etc.
• FluentSMTP: Modern, lightweight, great UI
• Easy WP SMTP: Simple and straightforward

Setup steps:

1. Install Contact Form 7 (or your chosen form plugin)
2. Create form and configure it normally
3. Install WP Mail SMTP or FluentSMTP
4. Go to settings → SMTP
5. Fill in SMTP details (server, port 587, username, password)
6. Send test email to verify
7. Done! Forms now use authenticated SMTP for better delivery

Custom PHP applications

For custom PHP sites, use a maintained mail library:

• PHPMailer: Mature, widely-used, supports SMTP and HTML email
• Symfony Mailer: Modern framework, excellent documentation
• SwiftMailer: Good alternative, similar to Symfony

Install via Composer:

composer require phpmailer/phpmailer

PHP code example with PHPMailer

<?php
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;

require 'vendor/autoload.php';

$mail = new PHPMailer(true);

try {
  // SMTP settings
  $mail->isSMTP();
  $mail->Host       = 'mail.yourdomain.com';  // Your mail server
  $mail->SMTPAuth   = true;
  $mail->Username   = 'forms@yourdomain.com'; // Email account in cPanel
  $mail->Password   = 'your-password';        // Email password
  $mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
  $mail->Port       = 587;

  // Email content
  $mail->setFrom('forms@yourdomain.com', 'Contact Form');
  $mail->addAddress('you@yourdomain.com');    // Where to send form data
  $mail->addReplyTo($_POST['email']);         // Reply to form sender

  $mail->isHTML(true);
  $mail->Subject = 'New Contact Form Submission';
  $mail->Body    = '<h2>Message from ' . htmlspecialchars($_POST['name']) . '</h2>' .
                   '<p>' . nl2br(htmlspecialchars($_POST['message'])) . '</p>';

  $mail->send();
  echo 'Message sent successfully!';
} catch (Exception $e) {
  echo "Email failed: {$mail->ErrorInfo}";
}
?>

Security best practices

1. Validate all input: Check email format, message length, required fields

   if (!filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
     exit('Invalid email');
   }

2. Sanitize form data: Remove dangerous characters and code

   $name = htmlspecialchars($_POST['name']);
   $message = htmlspecialchars($_POST['message']);

3. Prevent email header injection: Use a mail library (PHPMailer) which handles this automatically
4. Add CAPTCHA or rate limiting: Prevent spam bots and automated abuse

   // Rate limit: max 5 submissions per IP per hour
   $ip = $_SERVER['REMOTE_ADDR'];
   // Store submissions in database or cache
   // Block if IP exceeds limit

5. Never expose SMTP password in client code: Always use server-side SMTP; never in JavaScript
6. Hard-code the recipient address: Don't let forms accept arbitrary recipients

   // ✓ Correct: hard-coded
   $mail->addAddress('you@yourdomain.com');
   
   // ✗ Wrong: accepts any email from form
   $mail->addAddress($_POST['recipient']);

7. Set up SPF, DKIM, DMARC: Configure in cPanel to improve email authentication
8. Monitor for abuse: Check for suspicious form submissions, unusual volumes, or automated attacks

Troubleshooting form email issues

Form emails not arriving:

• Check spam/junk folder (SPF/DKIM not set up)
• Verify SMTP credentials are correct (test in cPanel webmail first)
• Ensure port 587 or 465 is not blocked (contact hosting provider)
• Check form error logs (PHP error log in cPanel)

Emails going to spam:

• Add SPF record: v=spf1 include:yourhostingprovider.com ~all
• Add DKIM: Generate in cPanel → Email Deliverability
• Set DMARC policy (basic): v=DMARC1; p=none;
• Make sure "From" address matches SMTP mailbox domain

Related: Email not sending | Sending limits | Secure your website | WordPress security

Related articles