Formjacking is the interception of information visitors enter into a web form without their permission.
Definition source: Sansec: What is Magecart?. Read on 24 October 2026. The practical questions on this page help you define the issue with your administrator.
What is hijacked in formjacking?
The target is the visitor’s input. A form may look normal and submit the intended request while malicious code also intercepts the information. Sansec uses formjacking as a term for web skimming involving payment forms.
A skimmerA web skimmer is malicious code that intercepts visitor information, for example during checkout. is the code performing that interception.
Separate this meaning from a broken form. An error after submission does not prove information theft. Equally, a confirmation email does not prove that the information went only to its intended recipient.
That conclusion requires knowing what the page did while someone filled in and submitted the form.
What might draw your attention?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
An unexpectedly added script or a warning about a form may justify investigation. Ask your administrator what changed and why it is considered suspicious. A form may legitimately connect to an agreed form service.
The purpose and destination of that connection therefore belong in the assessment.
Record which form is involved and whether it requests sensitive information. For an initial report, share the page address and a description, not completed customer records. Let a specialist decide how to check the behaviour without exposing visitors or real information to additional risk during testing.
What should you ask your administrator?
Ask which scripts the form needs and who manages them. Include changes made through external services. A Content Security PolicyA Content Security Policy (CSP) is a rule your site sends to browsers that lists where scripts, styles and images on a page may come from. All else is blocked. restricts permitted sources according to its configuration.
Subresource IntegritySubresource Integrity lets a browser check whether a loaded script or stylesheet matches its expected content. compares suitable external files with previously approved content. Neither mechanism is itself an investigation into information that may already have been stolen.
For a concrete suspicion, have the responsible person decide whether the form should be restricted temporarily. Agree what alternative visitors receive and who checks that requests are handled. Disabling a form without arranging follow-up may lose requests; treat that as a separate business decision made with the administrator.
When do you need specialist help?
If payment information may have been intercepted, contact the payment provider too. For other personal information, have the person responsible for privacy assess the required response. This page does not determine a reporting duty or deadline for your situation.
Ask the investigator to distinguish the website’s current behaviour from what can be established about an earlier period. The page may have changed since the first observation. A check today cannot automatically describe what previous visitors received.
Keep that limitation attached to any conclusion that you share with colleagues.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Does HTTPS prevent formjacking?
An encrypted connection answers a different question from what the page does with input. Have the form and its scripts assessed; a padlock is not a check for interception within the page.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.