We are sending emails to contacts, using Civimail, with a link to a webform. These contacts do not have a login to Civi so are seen by the webform as 'Anonymous (not verified)' users when they are submitted. However, those contacts are able to forward these emails to others, who are not contacts in Civi, who can then click on the link and complete the webform. When these unauthorised people do that, the webform sees them as the person who forwarded the email to them (because of the contact id in the link). Other than giving the original contacts a signin to Civi, is there a way of preventing this? This is a Drupal 7 site, Civi is at 5.35.2

  • 2
    in the email, you could add two buttons, one with the checksum which says "Andy register here" and the other "Others register here". Otherwise you could do a pop up on the form which says 'Yes I am Andy' or 'No I am not Andy' and then react differently based on their response
    – petednz - fuzion
    Commented Sep 24, 2021 at 19:13
  • Not sure I understand what you mean. Is the idea that if the email was forwarded then the recipients wouldn't click the button that said 'Andy register here'? But then they'd click the other button, wouldn't they? Or have I misunderstood?
    – Andy Clark
    Commented Sep 25, 2021 at 8:45
  • 2
    Yes you got it. the only other approach is a validation on the form that asks a person to confirm if they are indeed Andy, or are not. and if Not then just open a blank form
    – petednz - fuzion
    Commented Sep 26, 2021 at 19:51

2 Answers 2


That's one of the problems with checksum links - it's just a link connected to a specific user and although you sent the link to the specified contact, there is no guarantee that it is actually that person using it. The options come down to hoping people read your instructions and answer correctly.

You can ask people not to forward the mail ("Please don't forward this mail - it contains links to your personal data" ...) or either of the approaches Pete describes.

  • Thanks, Aidan & Pete. I was thinking maybe I was missing something, but you've confirmed I haven't.
    – Andy Clark
    Commented Sep 27, 2021 at 20:10

Another potential approach for webforms which I've used (in both Drupal 7 and Backdrop), is to adjust settings on the "Existing Contact" webform component for that contact.

In the "Contact Field Handling" section, you can configure it to lock the Contact Fields, Email, etc. if they contain data, leaving them open for editing if they are empty.

Contact Field Handling

In this way, if it's attached to an existing contact by a checksum the person will not be able to change the name/email data so it's very clear who they are filling the form for. But if they come to the form with no checksum and no pre-filled info, it's just a regular empty form.

EDIT: Regarding a contact reference field that is set up as autocomplete:

The first name and last name field will be "lockable", but the autocomplete contact reference does allow a user to remove the default selection and make a new selection. So they can see who they are filling the form out for (and potentially select a different contact) but not change the first/last name (or any locked info) of the existing contacts.

Autocomplete lock fields

  • Thanks, Laryn. The exting contact is an autoselect field so I can't use this, But at least it reminded me to restrict the choice to a group, which had got skipped.
    – Andy Clark
    Commented Sep 28, 2021 at 17:16
  • It might be worth trying it, even with the autoselect. If the field is locked when prefilled it can still display the name.
    – Laryn
    Commented Sep 28, 2021 at 18:02
  • It doesn't allow the field to be locked, I guess because it's an autoselect. But it's an interesting idea for another situation.
    – Andy Clark
    Commented Sep 28, 2021 at 18:14
  • Strange -- I just tested it (in Backdrop) and it works. I would expect it to work the same in Drupal 7.
    – Laryn
    Commented Sep 28, 2021 at 19:17
  • I have 'None' in 'Fields to Lock' and if I click the '+' I get an empty list. (Interesting that you are using Backdrop...but that's another story I'd like to discuss sometime soon...)
    – Andy Clark
    Commented Sep 28, 2021 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.