I've got a site using FreeForm 3.1.4 which is having a bit of an issue where guests are creating their own collection by, presumably, manipulating the source before submitting the form. As you can see from the attached screenshot we have several "collections" the ones that should be there are prefixed by HGI. All forms on this site are using honee-pot.

Is there a way to prevent this from happening? Back in February I posted this to the Solspace support forums but it wasn't resolved.

All suggestions greatly appreciated.

freeform screenshot

  • Sean, don't know if SE will let you but you should really unaccept my answer and accept Isaac's instead, because it's far better...
    – Tom Davies
    Dec 9, 2012 at 7:40
  • Tom, I'm planning on doing that after I test Isaac's addon on Monday at the office.
    – CreateSean
    Dec 9, 2012 at 12:51

2 Answers 2


I just wrote an extension for you which will let you do this. It's called Post Block. It allows you to specify a set of POST or GET fields which must contain certain values (or not contain certain values). If these conditions are not met, an error is shown and the form submission is blocked.

The condition you'd create in this case would be something like:

collection [not in list] contact_us|support|newsletter

This looks like this in the configuration:

enter image description here

This add-on will go up on Devot:ee soon, but you can download it directly from my site here.

Edit: Devot:ee page is now up.

  • Isaac this is awesome. it works for 3.1.4?
    – CreateSean
    Dec 7, 2012 at 22:03
  • 1
    It actually should work with any version of any form add-on - just looks at the POST values and blocks based on those. So you do need to specify the valid collection names, but it doesn't care which version of FreeForm you use. :) I'm also not 100% sure what the name of the parameter is, it's been awhile since I used FreeForm. You'll have to fiddle with it a bit but it will work. Dec 7, 2012 at 22:06
  • Isaac, I just installed and tested by changing the form name to "seans test" and it still went through. Could this be because this is a 9 site MSM install? I copied the settings in your screenshot above replacing the collection names with the appropriate ones. Is there somewhere I can contact you privately to discuss? -- edit sent twitter dm
    – CreateSean
    Dec 10, 2012 at 14:32
  • Always available for support at airways [%] mm.st. Dec 10, 2012 at 15:12
  • Note that the Devot:ee page for this extension is now up. Dec 27, 2012 at 4:15

Is updating to FreeForm 4 an option for you on this site?

A new post in the Solspace forum thread you linked to suggests that FF 4 no longer exposes collection ids via hidden form fields, so should prevent this from happening.

  • Tom, I noticed that and Nicolas Bottari told me on twitter that would be the best option. Though a 9 site MSM install with multiple forms on each site is not my idea of fun. Minor parameter changes for each form. Will have to find a good time to do this when the site is slow.
    – CreateSean
    Dec 7, 2012 at 16:17
  • 1
    Yeah I know your pain man. One other thing to watch out for that I've found when doing 3->4 updates of FreeForm is that sometimes the entire history of entries has disappeared without trace. No error msg, just gone. So defo make sure you have backups and the rest.
    – Tom Davies
    Dec 7, 2012 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.