# Website contact forms that actually get filled in: best practice for small businesses

> Contact form best practice for small business websites: which fields to ask for, how to lay them out, what happens after someone presses send, spam, GDPR and the mistakes that lose enquiries.

- Source: https://nerdsharks.com/blog/website-contact-form-best-practice
- Publisher: Nerdsharks (Exeter, Devon, UK)
- Updated: 2026-09-26

**Short answer:** Contact form best practice is to ask only for what you need to reply (usually name, a phone number or email and a message), label every field clearly, say how fast you will respond, show a clear confirmation after sending, send a copy to the customer, stop spam without puzzles and make sure every submission actually reaches someone who acts on it.

Published 2026-09-26. 9 min read. Category: Conversion and craft.

A contact form is the quietest salesperson on your website. When it works, enquiries arrive while you are on a job, at the school gates or asleep. When it does not, you never find out, because the customers who gave up simply went elsewhere.

This guide covers website contact form best practice for any small business: which fields to include, how to lay the form out, what the customer should see after pressing send, how to stop spam without annoying real people and how to keep the whole thing on the right side of UK data protection law.

## Ask for less than you think

Every field you add is another reason to stop. The question for each one is: do I need this to reply, or would it just be nice to have? You can always ask for the rest on the phone or by email once the conversation has started.

For most businesses the minimum is a name, one contact method and a message. Some businesses genuinely need more to give a useful answer, such as a postcode for a mobile service or a date for an event booking. That is fine, as long as each extra field clearly helps the customer get a better reply.

**Which contact form fields to include**

| Field | Include? | Why |
|---|---|---|
| Name | Yes | So you can address them properly |
| Phone number | Usually | Most small businesses reply fastest by phone; make it optional if email is enough |
| Email | Usually | For a written reply and to send a copy of the enquiry |
| Postcode or town | If you cover an area | Lets you check you serve them before replying |
| Service needed (dropdown) | Often | Speeds up triage; keep options short and include “Something else” |
| Message | Yes | Let people explain in their own words |
| Budget | Rarely | Useful for large projects; feels intrusive for small ones |
| Photo upload | For some trades | A photo of the leak, the damage or the garden can replace a site visit |
| How did you hear about us? | Optional at most | Nice for you, extra work for them |
| Company name, job title, address | Only if essential | Mostly relevant for B2B |

## Layout and wording that make forms easy

These are also accessibility basics. Visible labels, clear error messages and forms that work with a keyboard help everyone, and they line up with the WCAG 2.2 success criteria most accessibility checks use.

- One column. Side-by-side fields are harder to scan, especially on a phone.
- Labels above the fields, always visible. Placeholder text that disappears when you start typing is not a label.
- Mark optional fields as “(optional)” rather than scattering asterisks everywhere.
- Use the right input types so phones show the number pad for phone numbers and the @ key for email.
- Allow autofill. Browsers can fill in name, email and phone if the fields are set up properly.
- Show errors next to the field, in plain words: “Please add a phone number or email so we can reply”, not “Invalid input”.
- Name the button after the outcome: “Send my enquiry” or “Get my quote”, not “Submit”.
- Put a line near the button saying when you will reply, and how.

## Say what happens next

The biggest source of form anxiety is uncertainty. Will anyone read this? When? Will I be bombarded? Answer those questions right beside the form: “We reply within two working hours, Monday to Saturday. We will only use your details to respond to this enquiry.”

After someone presses send, show a proper confirmation, either on the same page or a dedicated thank-you page, that repeats the promise: what you will do, when, and how to reach you if it is urgent. Then send them an automatic email with a copy of what they wrote. It reassures the customer, and it gives them your details if they need to chase.

> A confirmation page is also the simplest thing to track in analytics: every visit to it is a real enquiry.

## Make sure enquiries actually arrive

The most expensive form failure is the silent one. The form looks fine to the customer, but the email never reaches you because it lands in spam, goes to an old address, or the website’s mail setup broke after a hosting change. Many business owners only discover this months later.

- Send a test enquiry at least once a month, from a phone, and check it arrives.
- Send form notifications to an address you check daily, ideally on your own domain.
- Make sure your website sends mail through a proper, authenticated service so it does not look like spam to Gmail or Outlook.
- Store submissions somewhere as well as email, such as a simple inbox in your website system or a CRM, so nothing is lost if an email goes astray.
- After any change to hosting, domain or email, test the form the same day.

## Stopping spam without punishing real customers

Spam is the reason many businesses add puzzles, image grids and “prove you are human” tests. Those also stop real people, particularly on mobile and particularly for anyone using assistive technology. Try the invisible options first:

- A honeypot field: a hidden field that people never see but bots fill in, so the submission is discarded.
- Time checks: forms submitted a fraction of a second after the page loaded are almost always bots.
- Server-side filtering of obvious spam content and links.
- Invisible or low-friction challenge services, used only if the above are not enough.

## Contact forms and UK GDPR

A contact form collects personal data, so UK GDPR applies. For most small businesses that is not complicated. You are collecting details to respond to a request the person has made, and you should tell them how you use their information in a privacy notice linked near the form. The ICO’s guidance on the right to be informed sets out what that notice should cover.

Do not add people who enquire to a marketing mailing list unless they have clearly agreed, or unless the “soft opt-in” for existing customers genuinely applies. A pre-ticked box is not consent. Keep enquiry data only as long as you need it, make sure the form is on a secure HTTPS page, and do not ask for sensitive information such as health details unless you really need it and have thought through how you protect it. This is general information, not legal advice; the ICO’s small business resources are the place to check.

## Contact form checklist

Every Nerdsharks site sends form enquiries into a simple inbox the owner controls as well as to email, precisely because silent form failures are so common. Whatever you use, test yours today; it takes two minutes.

- Three to five fields for most businesses, each one justified.
- Visible labels, one column, correct input types for phone and email.
- Button text that names the outcome.
- A reply-time promise next to the button.
- A clear on-screen confirmation and an automatic copy emailed to the customer.
- Submissions stored as well as emailed, and tested monthly.
- Invisible spam protection before any puzzle.
- A link to your privacy notice, no pre-ticked marketing boxes.
- Phone number and email visible near the form for people who prefer them.

## Questions

### How many fields should a contact form have?

Most small business contact forms need three to five fields: name, a phone number or email, and a message, plus a postcode or service dropdown if that genuinely helps you reply. Every extra field gives people another reason to stop, so ask for anything else once the conversation has started.

### Why am I not receiving emails from my website contact form?

Website form emails usually go missing because they land in spam, are sent to an old address, or the site is not sending mail through an authenticated service. A hosting or domain change can break it silently. Test the form from a phone, check spam folders and ask whoever runs the site to fix mail authentication.

### Do I need a privacy policy for a contact form?

Yes. If your contact form collects names, emails or phone numbers, UK GDPR requires you to tell people how you use that information, usually in a privacy notice linked near the form. It does not need to be long, but it must be accurate and easy to find.

### Is a contact form better than showing my email address?

A contact form and a visible email address work best together. The form guides people to give you the details you need and can be stored safely, while a visible email and phone number reassure people who prefer to contact you directly. Showing your email may attract some spam, which a good mail filter handles.

### Should I use a CAPTCHA on my contact form?

Use a visible CAPTCHA only if invisible methods fail. Honeypot fields, time checks and server-side filtering stop most form spam without asking real customers to solve puzzles, which can put people off and cause problems for users with disabilities.

## Sources

- The right to be informed, Information Commissioner’s Office, 2026: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/
- Web Content Accessibility Guidelines (WCAG) 2.2, W3C, Recommendation, October 2023: https://www.w3.org/TR/WCAG22/