A contact form on your website: have fields emailed and prevent spam

Do you want visitors to be able to email you through a form on your website? In this article you'll read how to create such a form, how to protect it against spam, and how to make sure the mail arrives properly.

Creating a form

• WordPress: use a form plugin, such as Contact Form 7. You don't need to do any programming yourself. A paid plugin isn't necessary.
• Your own HTML or PHP site: search for "creating an HTML form" for free examples. Have the form send via SMTP, not via the PHP function mail() (see below).

Preventing spam through your form

A form without protection is almost certainly going to be found by spambots. This means you'll receive a lot of spam, and in the worst case your form gets abused to send spam to others. So always protect your form:

• Captcha: a check that distinguishes humans from bots, such as Google reCAPTCHA or Cloudflare Turnstile. Contact Form 7 works with reCAPTCHA. For Turnstile you install a separate plugin, for example Simple Cloudflare Turnstile.
• Honeypot: a hidden field that humans don't see, but bots do fill in. If the field is filled in, the message isn't sent. There are also small plugins for this.
• Forums and blogs: for a lot of forum and blog software there's an integration with Stop Forum Spam. This keeps a list of IP addresses that send spam and blocks messages from those addresses.
• Keep your website up to date: keep WordPress, your theme, and your plugins updated at all times. An outdated plugin is a commonly used entry point for abuse.

Making sure mail from your form arrives properly

• Send via SMTP. With mail() in PHP, the sender becomes an address with the account name of your package, and you can't change that. Such mail often ends up in spam. Via SMTP you log in with a real mailbox and determine the sender yourself. In WordPress you use an SMTP plugin for this, such as WP Mail SMTP. For your own PHP script, read How can I get the correct sender with mail() in PHP?.
• Sender on your own domain. Have the form send mail from an address on your own domain, for example info@yourdomain.nl. Never use the visitor's email address as the sender: many recipients will then reject the mail. Put the visitor's address in the Reply-To field, then you can simply reply to the message.
• The SMTP details: the server name of your package, port 587 with STARTTLS or port 465 with SSL/TLS, and the email address and password of the mailbox. See All settings at a glance.

Is your form already being abused?

Are you receiving a lot of mail back that you didn't send, or is the server reporting that your sending limit has been reached? Then your form might be being abused. Read What to do if your email address has been abused and Sending limits and the "message limit reached" notification.