Delivering Bespoke Web Development Services

1<?php
2/**
3 * Registers a secure REST API endpoint for contact form submissions.
4 * Handles validation, sanitization, and simple rate limiting.
5 */
6add_action( 'rest_api_init', function () {
7    register_rest_route( 'plambech/v1', '/contact', [
8        'methods'             => WP_REST_Server::CREATABLE,
9        'callback'            => 'handle_contact_submission',
10        'permission_callback' => '__return_true',
11        'args'                => [
12            'name'    => [
13                'required'          => true,
14                'sanitize_callback' => 'sanitize_text_field',
15            ],
16            'email'   => [
17                'required'          => true,
18                'sanitize_callback' => 'sanitize_email',
19                'validate_callback' => 'is_email',
20            ],
21            'message' => [
22                'required'          => true,
23                'sanitize_callback' => 'sanitize_textarea_field',
24            ],
25        ],
26    ] );
27} );
28
29function handle_contact_submission( WP_REST_Request $request ): WP_REST_Response {
30    $name    = $request->get_param( 'name' );
31    $email   = $request->get_param( 'email' );
32    $message = $request->get_param( 'message' );
33
34    // Rate limiting via transients — one submission per IP per 10 minutes
35    $ip_key = 'contact_rate_' . md5( $_SERVER['REMOTE_ADDR'] );
36    if ( get_transient( $ip_key ) ) {
37        return new WP_REST_Response(
38            [ 'error' => 'Please wait before submitting again.' ],
39            429
40        );
41    }
42    set_transient( $ip_key, true, 10 * MINUTE_IN_SECONDS );
43
44    $sent = wp_mail(
45        get_option( 'admin_email' ),
46        "New message from {$name}",
47        "From: {$email}\n\n{$message}",
48        [ 'Content-Type: text/plain; charset=UTF-8' ]
49    );
50
51    return new WP_REST_Response(
52        [ 'success' => $sent ],
53        $sent ? 200 : 500
54    );
55}