I'm running into some trouble using the "hash" filter in Craft's first-party Contact Form plugin. The docs suggest using it like so:

<input type="hidden" name="redirect" value="{{ 'contact/thanks?from={fromName}'|hash }}">

On my development site, this is redirecting an otherwise-successful form to domain.com/hash_valuecontact/thanks?from=name, and therefore a 404 page.

Changing the value to '/contact/thanks?from{fromName}'|hash results in a more proper URL (domain.com/hash_value/contact/thanks?from=name) but still a 404. The docs suggest the hash is prepended to the value so the URL is expected but I'm not sure how the hash is decoded. And since the name is sent via the query string, I'm not sure what the hash is really doing in the first place, or why it's important.

So my question—is the hash actually important in this context, and if so how is it implemented? The docs don't contribute much information there. Thanks for any help.

1 Answer 1


In the context of the Contact Form plugin, the |hash filter is only necessary if you want to dynamically add recipients to the submission.

It is there to ensure that data isn't tampered with between the time it is submitted and the time that it hits Craft. Contact Form cares about this so malicious people/scripts don't turn your Craft install into an email SPAM relay machine.

Looks like you're using it on the hidden redirect parameter... it's completely unnecessary there, so you can remove it.

  • Thanks for the help, Brad. I only used hash on the redirect as it was included in the docs—I'm still not certain how it's meant to be implemented since it's prepended to the URL (throwing off the template parsing?). But at least my form is back on track! Aug 3, 2017 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.