Contact forms that convert: fields, spam and what happens after submit
The contact form is where most websites either earn a customer or lose one quietly. It usually gets five minutes of attention during a project and is never looked at again, even though it stands between every visitor and every enquiry. Here is what actually changes the number of messages you receive, from field count to the reply that follows.
Fewer fields, better fields
Every field is a small negotiation. The visitor decides whether answering it is worth the effort, and each extra question gives them another reason to close the tab.
For most service businesses the honest minimum is three fields: name, a way to reply, and what they need. Everything else should have to justify itself.
- Ask for either email or phone, not both, and let the visitor choose which one they prefer to share.
- Replace open text fields with simple choices where possible. A short list of services is faster to answer than an empty box.
- Never ask for information you could look up later or that only matters after the first conversation, such as a company registry code or a full address.
- Mark optional fields clearly. If nearly everything is required, people abandon rather than guess what is acceptable.
A longer form is sometimes deliberate, for example when you want to filter out unserious enquiries or need a budget range before quoting. That is a valid trade: fewer messages, better ones. Just make sure it is a decision, not an accident.
Where the form belongs
A single contact page in the menu is not enough. People decide to get in touch while reading about a service, not while looking for a page called Contact.
Put a short form or a clear call to action at the end of each service page, and repeat the contact option after long sections on pages people scroll.
Offer alternatives beside the form. A clickable phone number, an email address in plain text and a messaging option cover the people who will never type into a form at all.
On mobile, check the practical details: big enough tap targets, the correct keyboard for phone and email fields, and a submit button that does not hide behind the on screen keyboard.
Surround the form with the reasons to trust it: what happens next, how fast you reply, who will answer, and a line about how the data is used.
If you use a booking system, let people book directly instead of asking them to request a time by email. Removing one round of messages usually lifts conversions more than any wording change.
Stopping spam without punishing visitors
Form spam is inevitable, but heavy CAPTCHA is a poor answer. It slows down real people, it creates accessibility problems and it fails against services that solve challenges cheaply.
Start with a honeypot: a hidden field that humans never see and bots fill in. Submissions that contain it are discarded silently. This alone removes a large share of automated spam and is invisible to visitors.
Add a simple time check. A form submitted less than two seconds after loading was almost certainly not filled in by a person.
Server side validation of the message itself catches most of the rest: block submissions with many links, reject obvious patterns and rate limit by IP address.
If you still need a challenge, use an invisible or privacy friendly option, and check that it does not block screen reader users. Consider it a last layer, not the first.
Whatever you use, test that real submissions still arrive. The worst outcome is not spam in the inbox but a spam filter that quietly eats genuine enquiries for months.
What happens after submit
The moment after pressing send is where trust is won or lost, and it is the part most sites ignore.
Show a real confirmation, not a page that looks like nothing happened. Say that the message arrived, who will answer and within what time.
Send an automatic confirmation email that repeats what was submitted. It reassures the sender, gives them a record and proves the address was typed correctly.
Use a proper sending method so the message actually arrives. Forms that send through the default PHP mail function often land in spam. A transactional sending service or authenticated SMTP with correct SPF, DKIM and DMARC records solves this.
Send the notification to an address that someone reads, and add a second recipient for holidays and sick days. A shared inbox beats a personal one.
Then reply fast. Response speed matters more than almost any design detail: the business that answers within an hour usually wins the job from the one that answers in two days, regardless of who has the nicer website.
Data handling and measurement
A contact form collects personal data, so the basics of GDPR apply even to a small site.
Explain briefly next to the button what the data is used for and link to the privacy policy. Do not pre tick consent boxes, and keep marketing consent separate from the enquiry itself.
Do not add form submissions to a newsletter list automatically. Someone asking about a price has not agreed to receive marketing.
Keep enquiries only as long as you need them, and remember that the submissions stored in your website database are personal data too, not only the emails.
On the measurement side, track form submissions as a conversion in your analytics, along with clicks on phone numbers and email addresses. Without this you cannot tell which pages produce enquiries.
Review the actual messages every month. The questions people keep asking in the message box are usually answers that belong on the page itself, and removing that doubt earlier tends to produce more enquiries than redesigning the form again.
FAQ
How many fields should a contact form have?+
For most service businesses, three to four fields is the sweet spot: name, one contact method, and a description of what the person needs, plus optionally a simple service selector. Each additional field reduces completion, and fields that feel intrusive early in the process, such as company registry codes, full addresses or detailed budgets, cause the largest drop. The exception is when you deliberately want fewer but better qualified enquiries, for example if your team spends too much time on requests that never turn into projects. In that case adding a budget range or a project timeline is a reasonable filter, as long as you accept fewer total submissions in exchange. Whatever you choose, ask yourself for every field whether you genuinely need the answer before the first reply, and remove the ones that can wait.
Is CAPTCHA necessary to stop form spam?+
Usually not. A hidden honeypot field that bots fill in and humans never see, combined with a minimum time check and server side validation, blocks the majority of automated spam without adding any friction for real visitors. Rate limiting by IP address and rejecting messages stuffed with links removes most of what remains. Visible CAPTCHA challenges cost you real enquiries, create accessibility barriers for people using screen readers or with motor difficulties, and are not particularly effective against determined spammers who use cheap solving services. If spam still gets through after the simpler measures, use an invisible or privacy friendly challenge as an additional layer rather than a first line of defence, and test regularly that genuine submissions are still arriving in the inbox.
Why do form submissions end up in the spam folder?+
Almost always because of how the message is sent rather than what it contains. Many website forms send email directly from the web server using a default mail function, with a sender address belonging to a domain the server is not authorised to send for, which modern mail providers treat as forged. The fix is to send through an authenticated route: a transactional email service or proper SMTP with your own domain, with SPF, DKIM and DMARC records configured in DNS. Another common mistake is setting the sender address to the visitor's email, which makes the message look spoofed. Put your own address as the sender and the visitor's address in the reply to field instead. After any change, send several test submissions and check that they arrive in the main inbox, not just that no error appears on screen.