contact forms: a field note from a plant nursery

A phishing page copying a plant nursery appeared last year. The only reason their customers could tell it apart was that contact forms was set up correctly on the real site.

Two-factor on the registrar account is the single highest-value thing we do for a plant nursery when managing contact forms. Everything else can be rebuilt; a stolen domain cannot.

For a plant nursery, the boring path won: HTTPS, a backup that we have restored once on purpose, and a calendar reminder for contact forms.

The most expensive outage for a plant nursery was not a hack — it was query-string copies of the same page. Nobody attacked anything. The config just drifted.

We told a plant nursery that query-string copies of the same page was a ticking clock. They agreed to fix it the same week — which is rare. Most clients wait until it actually detonates.

The worst contact forms failure we have seen at a plant nursery was invisible for eight months. The backup existed but had never been tested, and the data inside was three migrations old.

More notes

Related notes

• Why contact forms matters for a walk-in clinic
• contact forms for a restaurant
• Managing contact forms at a plumber
• Managing contact forms at a marina