# Secure SMTP Contact Form Setup

The contact form posts to `send.php`, which now sends mail through authenticated SMTP.

## Required private folder

Create this folder one level above `public_html`:

```text
etna-private/
```

It must contain:

```text
etna-private/
├── config.json
└── SmtpMailer.php
```

The live files must therefore sit alongside `public_html`, not inside it:

```text
/home/your-cpanel-user/
├── etna-private/
│   ├── config.json
│   └── SmtpMailer.php
└── public_html/
    ├── send.php
    ├── contact.html
    └── ...
```

## Setup

1. Copy `private-config-example/config.example.json` to `../etna-private/config.json`.
2. Copy `private-config-example/SmtpMailer.php` to `../etna-private/SmtpMailer.php`.
3. Replace the example SMTP values in `config.json` with the actual Xneelo mailbox settings.
4. Keep the real password only in the private `config.json`.
5. Delete `public_html/private-config-example/` after deployment.

## Example JSON

```json
{
  "allowed_host": "arniston-etnas.co.za",
  "recipient_email": "arniset@mweb.co.za",
  "success_url": "thank-you.html",
  "smtp": {
    "host": "mail.arniston-etnas.co.za",
    "port": 587,
    "encryption": "tls",
    "username": "website@arniston-etnas.co.za",
    "password": "YOUR_REAL_PASSWORD",
    "from_email": "website@arniston-etnas.co.za",
    "from_name": "Etna's Southern Tip Website"
  }
}
```

## SMTP encryption

Use one of:

- `"encryption": "tls"` with the SMTP submission port supplied by Xneelo (commonly 587)
- `"encryption": "ssl"` with the SSL SMTP port supplied by Xneelo (commonly 465)

Use the actual values shown in the Xneelo email configuration for the mailbox.

## Recommended permissions

```text
etna-private/      700 or 750
config.json        600 or 640
SmtpMailer.php     600 or 640
```

Never use `777`.

## Security controls retained

- SMTP credentials stored outside the public web root
- TLS/SSL certificate verification
- Authenticated SMTP
- Host and origin validation
- Honeypot spam field
- Per-IP rate limiting
- Input validation and length limits
- Email-header injection protection
- Fixed enquiry-type allow-list
- Unique enquiry reference number
- Safe redirect after successful submission
- Server-side error logging without exposing SMTP errors to visitors


## Development Subfolder Support

`send.php` now searches upward through the server directory tree for the private `etna-private` folder. This allows the same contact form to work from both a live root install and a development location such as `/public_html/dev/arniston/`.

Recommended private location:

```text
/home/YOUR-CPANEL-USER/etna-private/
├── config.json
└── SmtpMailer.php
```

Keep this folder outside the publicly accessible website directory.


## Xneelo Absolute Paths

On xneelo, the `public_html` entry shown in File Manager is a symbolic link.

For an FTP username such as `arnisnszxv`:

```text
FTP home:    /usr/home/arnisnszxv/
Public web:  /usr/www/users/arnisnszxv/
Private:     /usr/home/arnisnszxv/etna-private/
```

Therefore the private SMTP files should be physically located at:

```text
/usr/home/arnisnszxv/etna-private/config.json
/usr/home/arnisnszxv/etna-private/SmtpMailer.php
```