Forms & security
A contact form is only useful if the enquiry reaches you
Seeing a success message is only one part of testing a contact form. The server may have accepted a message while delivery to the business inbox is still delayed or rejected. A complete check follows the enquiry from the visitor’s browser to the person who will answer it.
Test the full delivery path
Submit a clearly labelled test through the actual public form. Confirm it arrives in the expected mailbox, inspect the message details, and check where a reply would go. Repeat for each form type and important service selection. Also inspect spam folders and confirm that the notification address is an account someone monitors.
Use a consistent business sender
The notification should identify your business, while the visitor’s address belongs in the reply field. Hosting and email providers have their own sending requirements, so configure the form for the provider you actually use. After changes to mail hosting or DNS, repeat delivery tests instead of assuming the old setup still works.
Make errors understandable
Tell visitors which required information is missing and preserve their typed message when a request fails. A network interruption should not produce a misleading success state. Offer an alternative business email address for urgent problems. Avoid exposing internal server errors or configuration details in the response.
Keep a proportionate recovery process
A private recovery copy can help if an email notification disappears, but it creates information that must be protected and eventually removed. Limit access, keep it outside the public website directory, and describe the practice in your privacy notice. Decide who reviews failures and how long enquiries need to be retained.
Your next steps
- Verify arrival, not just the browser message.
- Check Reply-To and selected service details.
- Repeat tests after hosting or email changes.
- Protect and limit any recovery copies.