How Do You Set Up a Website Contact Form the Right Way?

By Bill Stilwell · Last reviewed October 16, 2026

The short answer

Every form on your site should have a clear business purpose, ask only what you need, show the right privacy and consent notices, confirm what happens next, block spam without blocking people, show clear error messages, and follow a set plan for how long submissions are kept and how they’re deleted. Write these choices down in a simple form register so they don’t drift over time.

Why it matters

Forms are where strangers hand you their personal information and ask for your help. When a form is unclear, broken, or hard to use, you lose the lead and may not even know it. When it collects more than you need, keeps it forever, or skips consent, you take on privacy risk for no benefit.

A made-up pest control company, Northside Pest Solutions, has three forms: a contact form, a quote request, and a newsletter signup. Each needs its own purpose, notices, confirmation, and retention plan. Treating them all the same way leads to mistakes, like adding quote requesters to the newsletter without asking.

Two related outline lines live on other pages. 13.5.2 Fields is covered by 11.6.1 Data Minimization. 13.5.4 Routing is covered by 13.2.8 Form Delivery.

The parts of a good form

13.5.1 Purpose

What it means: Each form or interactive tool, like a quiz or cost calculator, should exist for one business reason you can name.

How to do it: Start a form register. For each form, write its name, the page it’s on, its purpose, what it collects, where submissions go, and who owns it. If you can’t name a purpose, remove the form. Use the purpose to decide every other choice on this page.

Common mistake: Adding a quiz or survey because it seems engaging, then never using the answers.

What it means: People should know what you’ll do with their information and agree to anything beyond answering their request.

How to do it: Put a short line near the submit button, such as “We’ll use this to reply to your request. See our Privacy Policy,” with a link (see 13.4.7 Policy Pages). If you want to add people to marketing emails or texts, use a separate, unchecked checkbox for each, with plain wording about what they’ll get. Text message marketing has its own consent rules (see 18.4 Text Message Marketing Rules and 18.3 Email Marketing Rules). Save the consent wording, date, and time with each submission (see 12.6 Communication Consent Records).

Common mistake: A pre-checked “Send me offers” box, or treating a quote request as permission to send marketing.

13.5.5 Confirmation

What it means: After someone submits, they should see a message that says it worked and what happens next.

How to do it: Show a confirmation on screen, or send people to a thank-you page. Say what you received, when they’ll hear back, and how to reach you if it’s urgent. Send a confirmation email or text if you can. Make sure the reply time is one you keep (see 16.2.2 Lead Response Time).

Common mistake: A tiny “Sent” that’s easy to miss, so people submit three times.

13.5.6 Spam controls

What it means: Spam filters should stop robots without stopping real people, including people with disabilities.

How to do it: Start with the least intrusive tools. The World Wide Web Consortium (W3C), the group behind web accessibility standards, notes that traditional CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) puzzles create barriers for people with visual, hearing, and cognitive disabilities. It suggests trying options like honeypot fields first. A honeypot is a hidden field that people never see but robots fill in. Other options include server-side spam filtering, rate limits, and checks that run in the background. If you must use a puzzle, offer more than one type.

Common mistake: Adding a hard visual puzzle that blocks real customers, then wondering why form leads dropped.

13.5.7 Error handling

What it means: When something is wrong, the form should say what and how to fix it.

How to do it: Show errors in text next to the field, not only as a red outline. Say what’s wrong and how to fix it, like “Enter a 10-digit phone number.” Keep what people already typed so they don’t start over. Make sure screen readers announce the error. Web Content Accessibility Guidelines (WCAG) success criterion 3.3.1 says input errors should be identified and described to the user in text. Test it by submitting the form wrong on purpose.

Common mistake: A form that clears every field after one error, or a message like “Invalid input” with no detail.

13.5.8 Retention

What it means: Decide how long you keep form submissions and why.

How to do it: Set a period for each form in your register based on its purpose. A quote request that becomes a job becomes part of the customer record. A contact form that went nowhere may not need to be kept long. Check whether any submissions become contract, tax, or employment records that have their own rules (see 9.8.2 Record Retention Periods). Remember that copies live in more than one place: the form tool, your email, and your customer relationship management (CRM) system.

Common mistake: Keeping every submission forever in a form plugin nobody checks.

13.5.9 Deletion

What it means: Decide how submissions are deleted when the retention period ends or when someone asks.

How to do it: For each place a submission is stored, write how to delete it and who does it. Set a recurring reminder to clear old submissions. Have a process for privacy requests from customers (see 11.6.5 Customer Privacy Requests). Note the date of each cleanup in your register (see 9.8.5 Secure Record Destruction).

Common mistake: Deleting from the form tool but forgetting the copies in email notifications and the CRM.

When to get help from a pro

An attorney: for consent wording, text message consent, and retention periods. Ask:

Is my consent wording enough for the emails and texts I plan to send?
Which privacy laws apply based on where my customers live?
How long should I keep form submissions that turn into customer records?

A web developer or accessibility specialist: if your form errors, spam controls, or labels don’t work well with screen readers or keyboards.

Bill’s note

[Bill: add a short story or lesson here. For example, a client whose CAPTCHA blocked real leads, a pre-checked marketing box you’ve had to remove, or how you set up the SiteSmarty contact form.]

If you’d rather have this done for you, SiteSmarty builds and tests website forms for local businesses.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: each SiteSmarty form, its purpose, consent wording, spam control, and retention period]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the form with its consent line, a test error message, the confirmation, and the form register]
[Result so far:]

Questions people ask

What should a form say after someone submits it? Confirm you got it, say when they’ll hear back, and give a way to reach you if it’s urgent.

How do I stop spam without a CAPTCHA? Try a hidden honeypot field, server-side spam filtering, and rate limits first. The W3C recommends the least intrusive method that works.

Do I need a consent checkbox? You need a clear privacy notice. Use separate, unchecked boxes if you also want permission to send marketing emails or texts.

How long should I keep form submissions? Long enough for their purpose, then delete them. Set a period for each form and check whether any become records with their own rules.

How do I make form errors accessible? Describe each error in text next to the field, explain how to fix it, keep what people typed, and make sure screen readers announce it.

Audit check

Outline line	Question	Pass looks like	Fail looks like	Evidence to collect
13.5.1 Purpose	Does every form have a written business purpose?	A form register lists each form, purpose, data, destination, and owner	Forms nobody can explain or that collect unused data	The form register
13.5.3 Consent	Does each form show a privacy notice and get separate consent for marketing?	Privacy line with link. Separate unchecked marketing boxes. Consent saved with date and wording	Pre-checked boxes. No privacy link. Marketing sent without consent	Form screenshots and a sample consent record
13.5.5 Confirmation	Does every form confirm receipt and next steps?	Clear on-screen message or thank-you page plus a confirmation message with reply time	Tiny or missing confirmation. No reply time	Screenshots of confirmation screen and message
13.5.6 Spam controls	Do spam controls stop robots without blocking people?	Low-friction controls first. Any puzzle has alternatives. Spam levels watched	Hard visual puzzles only. Real leads blocked	Spam control settings and a test from a keyboard and screen reader
13.5.7 Error handling	Are errors clear, in text, and accessible?	Text errors by each field with fixes. Entries kept. Screen readers announce errors	Color-only errors. Vague messages. Fields cleared	Screenshots of test errors
13.5.8 Retention	Is there a set retention period for each form?	Period written in the register for every storage place	No period. Submissions kept forever	The form register
13.5.9 Deletion	Is there a working deletion process?	Steps for each storage place. Dated cleanup log. Privacy request process	Deleted in one place only. No log	Deletion log and process notes

Where this fits

Do this first: 13.3.5 Conversion Paths, 13.2.8 Form Delivery, 11.6.1 Data Minimization, 11.5 Data Map

Do this next: 13.6 Landing Pages and Funnels

Sources

World Wide Web Consortium (W3C), "Inaccessibility of CAPTCHA" (checked October 16, 2026)
W3C, "Understanding Success Criterion 3.3.1: Error Identification" (checked October 16, 2026)
U.S. Department of Justice, ADA.gov, "Guidance on Web Accessibility and the ADA" (checked October 16, 2026)
State of California Department of Justice, Office of the Attorney General, "Privacy Laws" (checked October 16, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.