How does a website contact form work?

A contact form collects the information a customer provides and passes it to the business in a controlled way. A good form checks the input, blocks as much spam as possible, sends the details over a secure connection and clearly confirms that the message was sent.

A form looks simple, but several things need to work correctly behind it.

What happens when a customer presses Send?

A typical sequence is:

The customer fills in the fields.
The browser checks things such as required information and the email address format.
The form sends the data over HTTPS (Hypertext Transfer Protocol Secure), an encrypted web connection, to a server or form service.
The backend checks the message and spam protection.
The message is stored or forwarded to the business in the agreed way.
The customer sees a success message or thank-you page.

The business still needs to handle the enquiry through its own process afterwards.

Which fields should you ask customers to fill in?

Ask only for information you actually need to handle the enquiry.

For many service businesses, this might be enough:

name
email or phone number
company, if relevant
what the customer needs
a free-text message field

A long form may provide more detail, but it also makes contacting you more of an effort.

If you can ask for something later in a conversation, you may not need it on the first form.

Does the form need spam protection?

In practice, yes, if it is public.

Bots search the web for forms automatically. Protection can include:

a hidden honeypot field
traffic assessment
a CAPTCHA check (Completely Automated Public Turing test to tell Computers and Humans Apart) or a Turnstile-style check, intended to distinguish automated spam from real users
server-side validation
submission rate limits

Good protection stops as much automated spam as possible without making real customers solve difficult puzzles.

Why does a message sometimes fail to reach the inbox?

The form may show the customer a success message while the business's email system still filters out the notification.

Use a form service or backend that sends notifications from a properly authenticated sender address, rather than pretending to send from the customer's email address.

The form also needs a real test after launch.

Test at least:

a normal successful submission
an invalid email address
a missing required field
mobile use
spam protection
whether the notification reaches the correct address
whether the user sees confirmation

Should customers receive an automatic confirmation email?

Not necessarily.

A clear on-page success message is often enough. An automatic email can be useful when you want to send a summary, reference number or expected response time.

The main thing is that customers are not left wondering whether their message went through.

What about privacy?

Explain clearly how personal data is handled alongside the form. The contact page should have an easy-to-find link to the privacy notice.

Collect only what you need for the purpose, and make sure the form does not send sensitive content without appropriate protection.

If the form or its spam protection uses cookies or other technologies that store information on the user's device, assess those too. Read whether your business website needs a cookie banner.

What makes a contact form more effective?

Working technology is not enough; customers also need a good reason to send the form.

The surrounding content should explain:

what happens after the enquiry
which information the business needs
whether making contact commits the customer to anything
other ways to reach the business

“Send” describes a technical action. A good page also explains why the customer should take it.

How does GC handle contact forms?

GC's service includes one standard contact form. Ongoing technical support also covers monitoring that the form works and fixing technical faults.

The contact process is planned as part of the whole website, rather than as an isolated box at the bottom of a page.