How to Set Up a Website Contact Form: Spam Protection, Email Delivery, and Testing

Overview

A small business website contact form usually has four connected parts: the form visitors see, the service or plugin that processes the submission, the notification email, and the inbox where messages are received. A problem in any one of these parts can make a form appear to work while enquiries disappear, arrive late, or land in a junk folder.

Before choosing a form tool, decide what the form needs to accomplish. A basic enquiry form may require only a name, email address, message, and optional phone number. A quote request, booking enquiry, or support form may need additional fields, but every extra question increases the effort required to submit it. Keep the first version focused on information you genuinely need to respond.

Your hosting setup matters as well. A free website builder, WordPress installation, static site, and traditional hosting account may use different form tools and email settings. Check whether your platform includes form processing, requires an add-on, or expects you to connect an external service. If you are still choosing a platform, the guide to free website builders versus hosting can help clarify the difference between these arrangements.

Checklist by scenario

For a basic enquiry form

• Use a clear heading such as “Send us a message” or “Request a callback.”
• Include only essential fields: name, email address, and message.
• Label every field visibly rather than relying on placeholder text alone.
• Mark required fields clearly and make the submit button describe the action, such as “Send enquiry.”
• Display a confirmation message after submission so visitors know whether the form worked.
• Send notifications to an inbox that is checked regularly.

For a quote, booking, or project enquiry

• Ask for the service or project type using a short list of relevant options.
• Provide a realistic budget or timeframe field only if it helps you qualify the enquiry.
• Allow visitors to describe their needs in their own words.
• Do not require sensitive information that is unnecessary at the initial enquiry stage.
• Route notifications to the person or team responsible for responding.
• Use an autoresponder only for a useful confirmation, such as expected next steps or alternative contact details.

For a form on a free or low-cost hosting plan

• Confirm that the host or site builder supports form submissions and outgoing notifications.
• Check whether submission limits, storage limits, or upgrade requirements apply.
• Prefer a supported form integration over a custom script if you are not comfortable maintaining server-side code.
• Keep a backup route, such as a visible business email address or phone number, while testing.
• Review the provider’s documentation when platform settings change. Hosting limits can affect practical site features, as explained in this free hosting limits guide.

For a WordPress website

• Choose a maintained form plugin or trusted hosted form service.
• Keep WordPress, the form tool, and related extensions updated according to the platform’s normal maintenance process.
• Configure the notification recipient, sender address, and reply-to address separately.
• If direct website email is unreliable, use a properly configured SMTP or transactional email connection supported by your provider.
• Test after plugin, theme, hosting, or domain changes.

What to double-check

Sender and reply-to settings

Use an address on your own domain as the message sender when your platform and email setup support it. Set the visitor’s email address as the reply-to address, rather than replacing the sender address with an address entered by the visitor. This makes it easier to reply while keeping the notification configuration consistent.

If you send mail from a custom domain, review the domain’s email authentication settings with your email provider. Depending on the service, this may involve SPF, DKIM, or DMARC records. These settings should be copied from the provider’s current instructions rather than guessed, because incorrect DNS records can affect delivery. Allow time for DNS changes to take effect, then send controlled test messages.

Spam protection

Spam protection should reduce automated submissions without making the form difficult for genuine visitors. Start with a sensible combination of validation, rate limiting, and a hidden honeypot field if your tool supports it. A challenge such as CAPTCHA may be appropriate when spam remains a problem, but use the least disruptive option that addresses the issue.

Do not treat spam protection as a substitute for reviewing submissions. Check whether your form tool filters suspicious entries, stores them, or discards them. Make sure legitimate enquiries are not silently removed without a review or recovery option.

Consent and privacy

Explain why you are collecting each non-essential piece of information. If you plan to add people to a marketing list, use a separate, clear opt-in rather than assuming that an enquiry is permission for ongoing promotional email. Link to the site’s privacy information where appropriate, and avoid collecting passwords, payment details, or other sensitive data through a basic contact form.

Accessibility and mobile use

Check that labels, error messages, focus states, and keyboard navigation work as expected. On a phone, fields should be easy to tap and the submit button should remain visible without excessive scrolling. Use suitable input types for email addresses and telephone numbers so mobile keyboards provide the right controls.

Troubleshooting table

Common mistakes

• Using too many fields: Ask for the minimum information needed to begin a conversation.
• Testing only the visual layout: A form can look correct while its notification route is broken. Always test an actual submission.
• Sending from the visitor’s address: Use a stable domain address for the sender and place the visitor’s address in reply-to when supported.
• Relying on one inbox: Use an appropriate shared mailbox, dashboard, or backup notification route when missing an enquiry would be costly.
• Forgetting the success message: Tell visitors what happened and what they should do if they do not receive a response.
• Ignoring site changes: A domain move, DNS update, hosting migration, plugin update, or email-provider change can affect form delivery.
• Publishing without an alternative contact method: Provide a clearly displayed email address or phone number while the form is being introduced and tested.

When to revisit

Run a complete contact form test before launching a website, after changing hosts or domains, and whenever you change the form tool, email provider, DNS records, or notification recipient. Test from a desktop browser and a mobile device, then confirm that the message arrives in the intended inbox and that replying reaches the visitor.

For an established small business website, add a form test to a quarterly website review or to the start of each seasonal planning cycle. Revisit the fields when your services change, review spam controls when unwanted submissions increase, and check the privacy wording when you add a newsletter, booking system, analytics tool, or other service.

Use this final launch sequence: submit a realistic test, verify the confirmation message, check the notification inbox and junk folder, reply to the test, confirm the reply reaches the test address, repeat on mobile, and record the date and result. If a message is missing, work through the troubleshooting table before promoting the form. Pair this check with a broader website speed and uptime review so the form remains usable as well as deliverable.