Contact Forms

Information checked: 21 July 2026.

A contact form should make an enquiry easier without becoming the only record of it. Reliable forms validate input, explain what happens to personal data, resist abuse and create an auditable delivery path.

In brief: Treat the submitted enquiry as business data first and an email notification second.

Ask only for what the team will use

Common form fields

Field	Use it when	Risk to avoid
Name	A person must be addressed or identified	Making unnecessary fields mandatory
Email or phone	The business will reply through that channel	Collecting both without need
Service or location	It changes routing or qualification	Long confusing dropdowns
Message	Free context is genuinely needed	Requesting sensitive information in an ordinary form
File upload	The workflow requires a document	Malware, oversized files and accidental disclosure

Build a reliable submission path

Validate on the server as well as in the browser. Store or log the submission safely before attempting notification. Send from an authenticated business-domain address and use the visitor’s address as Reply-To where appropriate.

Protect privacy and security

• Provide a short privacy explanation beside the form and link to the full notice.
• Do not use the enquiry as marketing consent unless the user makes a separate informed choice.
• Rate-limit and filter abuse without making the form impossible for real users.
• Restrict file type, size and storage location; scan uploads and keep them outside executable paths.
• Delete enquiries according to a documented retention rule.

Test more than a success message

1. Submit valid and invalid data on mobile and desktop.
2. Use keyboard navigation and screen-reader labels.
3. Test long names, international phone numbers and apostrophes.
4. Confirm the internal record, notification and customer confirmation.
5. Turn the email notification off temporarily and verify the enquiry is still recoverable.
6. Test spam controls without blocking a legitimate repeated attempt.

Acceptance criterion

A form is ready when a staff member can find, respond to and audit an enquiry even if one notification message is delayed or filtered.

Example: an enquiry lost in spam

The visitor sees a success message, but the only notification is filtered and no database record exists. The business cannot prove what was submitted or contact the customer. A reliable form writes an auditable record, displays a reference or confirmation, then sends notifications with monitoring and retry where appropriate.

What the business should retain

• Form field and purpose register
• Privacy wording version
• Submission storage and retention
• Mail-delivery logs
• Spam and upload-control settings

Sources and date checked

Technical and product information was checked against the following primary sources on 21 July 2026. Plans, interfaces and provider terms can change, so recheck them before purchase or migration.

• ICO privacy notice generator and guidance for small organisations
• OWASP Input Validation Cheat Sheet
• OWASP File Upload Cheat Sheet