How does a contact form work?

What happens when someone clicks send?

From the outside it looks simple, but a few steps take place one after another:

1. The visitor fills in the fields, for example name, email address and message.
2. On submission, the browser sends that data to a script on the web server.
3. The script checks whether everything is correct and complete.
4. It then composes an email and sends it to your inbox. Sometimes the message is stored as well.
5. The visitor is shown a confirmation that the message has arrived.

The email you receive comes from your own server, with the visitor's address as the reply address. That way you can reply with a single click.

Why validation matters

Validation is the checking of the details entered. That happens in two places. In the browser, the visitor is told immediately about an empty required field or an email address without an @ — pleasant, but not reliable, because that check can be bypassed. This is why the script on the server always checks everything again. That second check is the real one: only what is approved there reaches you.

Stopping spam

A public form inevitably attracts automated spam. There are two widely used techniques:

• HoneypotA hidden field that people do not see and therefore leave empty. If a bot does fill it in, the submission is ignored. Invisible to your visitor.
• reCAPTCHAA service that assesses whether the sender is human. Modern versions usually work in the background, without little puzzles.

In addition, it helps to limit the number of submissions per period and to block suspicious content.

On a website without a CMS too

A common misconception is that you need a CMS for a working form. That is not the case. A static HTML website can perfectly well have a form too: only that one small script on the server does the work, while the rest of the site stays static. So you keep the speed and security of a static site, with fully fledged functionality. Because this script is the only dynamic component, it deserves extra attention when it comes to security — see also a website that cannot be hacked.

Privacy and the GDPR

With a form you are processing personal data, so rules apply. Keep it practical:

• Only ask for what you genuinely need in order to reply.
• Make sure the site works over https, so that the submission is encrypted; see SSL certificate and https.
• Briefly explain what you use the data for and refer to your privacy statement.
• Do not keep submissions longer than necessary and secure the place where they end up.

A form that simply works

A good form is short, clear and gives tidy error messages. Test regularly whether messages actually arrive — otherwise you will only notice a silent failure when clients complain that they are not hearing back. You can see an example of how we do this on our own contact page.