diff --git a/content/misc/contact.php b/content/misc/contact.php
index 3ee60ed..c7e1751 100644
--- a/content/misc/contact.php
+++ b/content/misc/contact.php
@@ -1,6 +1,19 @@
 <?php
 // inspired by: https://www.unixdude.net/posts/2017/Nov/29/pelican-contact-form/
 
+// make sure method is POST
+if ( $_SERVER['REQUEST_METHOD'] != 'POST' ) {
+  header('Location: /');
+  exit;
+}
+
+// make sure all required fields are set
+// HTML already validates this, but bots sometimes call the script directly 
+if ( $_POST['name'] == '' or $_POST['email'] == '' or $_POST['nachricht'] == '') {
+  header('Location: /');
+  exit;
+}
+
 // The 'address' form field is in the code but doesn't get rendered on the page. The message will only get sent if the field is empty, thus weeding out bots that will just fill out any form field 
 if ( $_POST['address'] != '' ) {
   header('Location: /');