Disable Joomla Contacts component (com_contact) in MySQL / phpMyAdmin

Often the built-in Joomla contact forms component (com_contact) is abused by spammers. These contact forms allow the sender to receive a copy of the form contents, and all spammers need to do is enter the email address of their target as sender/from. This way, anyone can use the Joomla contact form for spamming anyone. This short article explains how to disable and combat this.

Whenever you see prefix_, substitute that with the prefix of your database tables, for example jos_. So prefix_extensions becomes jos_extensions.

Disable the Send Copy to Submitter global option in MySQL

To disable the 'Send a copy to yourself' option:

1. Log on to your MySQL database using phpMyAdmin or the MySQL CLI.
2. Look up the com_contact information in the prefix_extensions table: SELECT * FROM `prefix_extensions` WHERE name = "com_contact";
3. Set "show_email_copy":"1" to 0. Be careful editing JSON directly, so use MySQL/MariaDB's JSON_SET() function to edit this key/value pair: UPDATE prefix_extensions set params = JSON_SET(params, "$.show_email_copy", "0") where extension_id = 8;

This assumes component com_contact has extension_id 8; the first SELECT query provides its id number.

Set show_email_form to 0 too, to disable the form completely:

update `prefix_extensions`
set params=JSON_SET(params, "$.show_email_form", "0", "$.show_email_copy", "0")
where extension_id = 8;

Hide Send Copy to Submitter in the Joomla Control Panel

In your Joomla Control Panel, use the following path:

1. System > Global Configuration
2. select Contacts in the COMPONENT list, and
3. set Send Copy To Submitter to Hide.

I've just re-done this in Joomla 3.9.23, in which the default option is not to show the Send Copy to Submitter option. I'm not sure when this was turned off by default.

Flexi Contact

FlexiContact is a free contact form extension for Joomla that is easy to set up. When FlexiContact is in use, disable its send a copy option by setting show_copy to 0 for the component com_flexicontact. You can do this the same way as for Joomla's com_contact.

Spam is not the only way Joomla websites get abused: read how Joomla websites are abused as open proxy in denial of service attacks.