A contact form is the set of fields on a website that lets visitors send you a message without opening their email program — behind the scenes a small script processes the details entered and forwards them as an email.
What happens when someone clicks send?
From the outside it looks simple, but a few steps take place one after another:
- 1The visitor fills in the fieldsFor example name, email address and message.
- 2The browser sends the dataWhen sent, it goes to a script on the web server.
- 3The script checks the inputIs everything correct, and is it complete?
- 4The script turns it into an emailAnd sends it to your inbox. Sometimes the message is also stored.
- 5The visitor gets a confirmationThey can see that the message has arrived.
The email you receive comes from your own server, with the visitor's address as the reply-to address. That way you can reply with one click.
Why validation matters
Validation means checking the data entered. That happens in two places:
Convenient, but not reliable
- The visitor immediately gets a message for an empty required field, or an email address without an @.
- This check can be bypassed.
The real check
- The script on the server always checks everything again.
- Only what is approved there reaches you.
Stopping spam
A public form inevitably attracts automated spam. Two techniques are widely used:
Honeypot
A hidden field that people do not see, and therefore leave empty. If a bot fills it in anyway, the submission is ignored. Your visitor does not notice a thing.
reCAPTCHA
A service that assesses whether the sender is human. Modern versions usually work in the background, without little puzzles.
It also helps to limit the number of submissions per period and to block suspicious content.
On a website without a CMS too
A common misconception: that you need a CMS for a working form. That is not true; a form works perfectly well on a static HTML website.
Only that one small script on the server does the work, while the rest of the site remains static. So you keep the speed and security of a static site, with full functionality.
Good to knowBecause this script is the only dynamic component, it deserves extra attention when it comes to security. See also a website that cannot be hacked.
What is more, it is often the only bit of PHP on such a site. In the event of a PHP vulnerability, only the form goes offline for a while, and the rest stays online. More about that at website without PHP.
Privacy and the GDPR
With a form you are processing personal data, so rules apply. Keep it practical:
- Ask only for what you really needEnough to be able to reply, and no more.
- Make sure the site works via httpsThen the submission is encrypted; see SSL certificate and https.
- Say what you use the data forBriefly, with a link to your privacy statement.
- Do not keep submissions longer than necessaryAnd secure the place where they end up.
A form that simply works
Short and clear
A good form is short, clear and gives tidy error messages.
Test it regularly
Do messages really arrive? Otherwise you will only notice a silent failure when customers complain that they have not heard anything.
You can see an example of how we do this on our own contact page.