Building a Contact Form That Works and Resists Spam

A contact form is simple to build and easy to get subtly wrong. A few habits make it usable, accessible and far less attractive to bots.

An HTML form is one of the first interactive things most small sites need. The markup is straightforward; the care goes into making it clear to people, usable with a keyboard and a screen reader, and unappealing to automated spam.

Label everything, properly

Every field needs a real <label> tied to its input, not just placeholder text that vanishes as you type. Proper labels help everyone, and they are essential for people using assistive technology. Group related fields and keep the order logical.

Validate on both sides

• In the browser, use the right input types and required so people get instant, friendly feedback.
• On the server, validate again. Browser checks are for convenience and can be bypassed; the server is where you actually trust nothing and verify everything.

Reduce spam without punishing people

CAPTCHAs frustrate real visitors. Lighter measures catch most bots first: a hidden "honeypot" field that humans never fill, a minimum time-to-submit, and server-side checks on the content. Add a stronger challenge only if spam gets through, and choose an accessible one.

Handle the submission safely

Treat every submitted value as untrusted. Escape or sanitise input before storing it or putting it in an email, send over an encrypted connection, and never expose secret keys in client-side code. Tell the sender clearly whether the message went through; a form that silently fails costs you real enquiries.

Respect privacy

Collect only the fields you truly need, say what you will do with them, and do not quietly wire the form up to trackers. A short, honest note under the form builds more trust than a page of legal text nobody reads.

Make sure messages actually reach you

A contact form's one job is delivery, and email is where it quietly fails: messages sent from your server are often filtered as spam before you see them. Send through a proper mail service rather than a raw server function, set up the sending records that let receivers trust your domain, and store each submission in a database or log as a backup. Then send yourself a test from an outside address every so often, because the enquiries you never knew you missed are the most expensive kind.

The minimum that is actually good

Real labels, two-sided validation, a honeypot, encrypted transport, and a clear confirmation. That is a form that works for people and holds up against bots, without a heavy framework.

// checked 2026-11-10