A contact form on your website: emailing the fields and preventing spam

Want visitors to be able to email you through a form on your website? This article explains how to create a form, how to protect it against spam and how to make sure the mail arrives properly.

Creating a form

• WordPress: use a form plugin, such as Contact Form 7. You don't need to do any programming yourself, and you don't need a paid plugin.
• Your own HTML or PHP site: search for "create HTML form" to find free examples. Have the form send its mail via SMTP, not via the PHP function mail() (see below).

Preventing spam through your form

A form without protection will almost certainly be found by spambots. You'll then receive a lot of spam, and in the worst case your form will be abused to send spam to others. So always protect your form:

• Captcha: a check that tells humans and bots apart, such as Google reCAPTCHA or Cloudflare Turnstile. Contact Form 7 works with reCAPTCHA. For Turnstile, install a separate plugin, for example Simple Cloudflare Turnstile.
• Honeypot: a hidden field that people don't see, but bots do fill in. If the field has been filled in, the message isn't sent. There are small plugins for this as well.
• Forums and blogs: a lot of forum and blog software has an integration with Stop Forum Spam. It keeps a list of IP addresses that send spam and blocks messages from those addresses.
• Keep your website up to date: always update WordPress, your theme and your plugins. An outdated plugin is a common entry point for abuse.

Comments on your blog or in your forum

Spambots don't just post messages through forms, they also post comments with links, hoping search engines will count those links. Here's how to prevent that:

• Have comments approved first. In WordPress, go to Settings › Discussion and enable the option that a comment must be manually approved. If you don't use comments, switch them off completely.
• Use an anti-spam plugin or captcha for comments, just like for your form.
• Mark links in comments. Links that visitors post themselves should have rel="ugc" or rel="nofollow". That way search engines know you don't vouch for that link. WordPress has done this automatically since version 5.3. For other software, check the settings or look for a plugin.

How to make sure the mail from your form arrives properly

• Send via SMTP. With mail() in PHP, the sender becomes an address with your package's account name, and you can't change that. Mail like this often ends up in spam. With SMTP, you log in with a real mailbox and choose the sender yourself. In WordPress, use an SMTP plugin for this, such as WP Mail SMTP. For your own PHP script, read How do I get the right sender with mail() in PHP?.
• Sender on your own domain. Have the form send mail from an address on your own domain, for example info@yourdomain.com. Never use the visitor's email address as the sender: many recipients will reject the mail. Put the visitor's address in the Reply-To field, so you can simply reply to the message.
• The SMTP details: your package's server name, port 587 with STARTTLS or port 465 with SSL/TLS, and the email address and password of the mailbox. See All settings at a glance.

Is your form already being abused?

Are you getting lots of bounced mail you didn't send, or is the server reporting that your sending limit has been reached? Then your form may be being abused. Read What to do if your email address has been abused and Sending limits and the 'message limit reached' notice.

Want to learn more? Take the free WordPress course, lesson 9.1 Email from WordPress.