Your contact form probably lies to people
A validated form that shows a success message and sends nothing is worse than no form at all. Here is how to tell, and what a correct one does.
We audited this very site a few weeks ago and found the bug we see most often in small-business websites: the contact form validated four fields, showed a friendly “Got it, we’ll come back to you shortly”, and then did absolutely nothing with the message.
No request left the browser. Every person who filled it in walked away believing they had reached us. That is not a missing feature — it is an active lie told to the people most likely to buy from you.
How to check yours in thirty seconds
Open your site, press F12 to open developer tools, and click the Network tab. Now fill in your own contact form and submit it. If no new request appears in that list when you press send, nothing was sent. It is that simple, and it takes less time than reading this paragraph.
The second test is even easier: submit the form and see whether an email actually arrives. Check the spam folder too — a form that sends mail nobody reads has the same business outcome as one that sends nothing.
What a correct endpoint does
- Validates again on the server. The browser check is a courtesy; anything can post directly to your endpoint.
- Sends from your own domain, with the visitor in Reply-To. Sending as the visitor is the usual reason these land in spam — your domain has not authorised their address.
- Rejects newlines in any value that reaches a mail header, or your form becomes an open relay for spammers.
- Fails loudly. If the mail cannot be sent, the form must say so and show an address to write to instead.
- Carries a honeypot field — a hidden input that humans never fill and bots always do.
The failure case is the whole point
Most forms are tested once, on a good day, and never again. The interesting question is what happens when the mail server is down. If the answer is "the visitor sees the same success screen", you have built a lead shredder with excellent user experience.
Ours now keeps the form on screen, explains that the message could not be sent, and prints the email address to write to instead. Less pretty, honest, and it does not cost you the customer.