A contact form is a small business workflow: a visitor shares information, the website stores or forwards it, and somebody responds. Good design makes that process clear and dependable. A form that appears successful while losing the enquiry is a business failure, even if the animation looks polished.
Collect only what the first conversation needs
For a company website, a name, business contact method and project summary may be enough. Budget range or preferred service can be optional when they help route the enquiry. Avoid requesting identity documents, customer records or detailed confidential specifications during an initial public submission.
Explain what the information will be used for and link to the relevant privacy information. Separate optional marketing permission from the request for a project response. The exact lawful basis, wording and retention obligations need review for the organisation and jurisdiction; adding a checkbox alone does not establish compliance.
Validate on the server
Browser validation helps visitors fix mistakes quickly, but requests can reach the endpoint without using the interface. The server should check expected fields, permitted values, length limits and total request size. Reject malformed data with an understandable response.
A practical review might include:
| Input | Expected handling |
|---|---|
| Missing required contact field | Ask for the field without clearing the summary |
| Unexpected service identifier | Reject or handle through an explicit allowed list |
| Extremely long message | Reject within a documented limit |
| Repeated submission | Avoid unintended duplicate records |
| Text containing markup | Store and display it safely as appropriate |
Do not reveal internal database details or raw exceptions in public errors. Use a supportable error category while keeping diagnostic information in protected operational logs.
Treat abuse prevention as a server responsibility
Rate limits, request bounds and bot checks address different forms of abuse. A bot widget alone does not establish that the backend is protected. For example, Cloudflare requires the server to validate Turnstile tokens; the visual widget is only one part of that process.
Choose a limiter suitable for the deployment environment and understand whether it works across application instances. Trust client-address headers only when the hosting or proxy configuration establishes their origin. Otherwise an attacker may influence the identifier used for limiting.
Review origin and request-forgery protection according to the endpoint's authentication and browser behaviour. An unauthenticated enquiry form has different risks from a logged-in settings change, so copy-pasting an unrelated security pattern can create gaps or unnecessary friction.
Save first, confirm second
Define what success means. It might mean an enquiry was durably stored, rather than that an email notification was already delivered. Return success only after the required action has completed. If notification delivery is separate, log its state and provide a retry mechanism for the team.
A fictional design studio could store an enquiry with a reference number, then notify its sales inbox. If the email provider fails, the record should remain visible to authorised staff. The public message can confirm receipt without promising that a particular employee has read it.
Test the inconvenient states
Test a slow connection, server failure, rejected bot token and expired verification. Keep entered information where it is safe and practical. Make progress, errors and confirmation perceivable to assistive technology. Avoid a thank-you page that falsely implies receipt when somebody opens its URL directly.
Include duplicate clicks and retries after a timeout. A request identifier can help the server distinguish the same intended submission from a new enquiry, subject to a clear implementation and retention policy.
Operate the inbox responsibly
Restrict who can view and export enquiries. Decide how long records are retained and how deletion is handled. Avoid copying full message contents into broadly accessible analytics or logs.
Assign an owner for unread enquiries and an escalation route when notifications stop. Monitor successful saves and delivery failures separately. The best contact form combines a short visitor journey with a reliable, observable process behind it.
Primary references
Related reading
- Website Security Checklist for Business Owners
- Website Accessibility Audit: Check Real Visitor Tasks
Explore our web apps to plan a practical implementation around your team's needs.