How to tell if your contact form is working

Facts checked on October 22, 2026, each against its source. Every number links to where it came from.

A broken contact form is easy to miss. Nobody writes to say they couldn't write to you, so the problem looks like a quiet week.

Where a message can get lost

Between someone pressing Send and you reading it, a message passes through several steps:

1. Spam protection decides whether the sender is a person.
2. The form checks the answers and saves them, or doesn't.
3. Your site sends you an email about it.
4. Your email provider decides whether to trust that email.
5. It lands in your inbox, your spam folder, or nowhere.

A test has to go through all of them. Testing from your own logged-in browser skips the first two.

Test it end to end

1. Use a phone on mobile data, not your office Wi-Fi, and not logged in to your site.
2. Fill it in as a stranger would, with a personal address at a different provider from your business email.
3. Check the page says it was sent. The W3C's accessibility guidance asks for a clear success message, so people know the form worked¹. If the page just reloads, people will try again, or give up.
4. Check your inbox, then your spam folder. Do it on the device you actually read email on.
5. Find it where your platform stores it. See below.
6. Reply to it. The reply should go to the visitor's address, not back to your own website.

Repeat it after any change to the site, the form, your email or your domain.

Where your platform keeps the messages

• Wix. Every submission is stored in the Forms & Submissions dashboard, and you get a notification by email and in the Wix app². Submissions its spam filter catches sit in a spam tab for 30 days, then are deleted for good³, so look there too.
• Squarespace. Each form needs at least one storage option connected; with none, visitors can't submit it. And form emails are turned off on trial sites⁴, which trips people up when they test before launch.
• WordPress. Most form plugins can keep a copy of each entry in your dashboard. Turn that on: email from WordPress is the weakest link, and WordPress's own documentation says a successful send doesn't mean the email was received⁵.

Why form emails end up in spam

Gmail and Yahoo have tightened their rules. Since February 1, 2024, Gmail has required everyone sending to its users to authenticate their mail with SPF or DKIM⁶, and mail that doesn't meet its rules may be rejected or sent to spam⁷. Yahoo asks the same of all senders⁸. SPF and DKIM are records on your domain that tell providers which servers may send email for it. If your website sends from a server your domain doesn't list, the email looks forged.

A common mistake is the From address. Many forms send the notification "from" the visitor, so you can press Reply. But DMARC, the standard providers use to catch forged mail, checks that the domain in the From address matches a domain that authenticated the message⁹, and your web server can't authenticate for gmail.com or yahoo.com. When the visitor's provider publishes a strict policy, Yahoo rejects mail that claims to be from it without that match¹⁰.

Send from an address at your own domain instead, and put the visitor's address in Reply-To. That's what Reply-To is for: it tells your email app where replies should go¹¹. Most form plugins and site builders have a setting for it.

To check what a provider made of your test message:

• In Gmail, open it, choose More, then Show original¹², and look for SPF, DKIM and DMARC marked as passed.
• Add your platform's sending address to your contacts. Wix sends from no-reply@wixsiteautomations.com, and says to check its Recipients field too¹³; Squarespace sends from form-submission@squarespace.info¹⁴.

Spam protection that turns people away

Spam protection is a guess about who's human, and some guesses are wrong. Google's reCAPTCHA v3 scores each visit from 0.0 to 1.0, suggests 0.5 as a starting threshold, and recommends acting quietly on low scores rather than blocking people¹⁵. Cloudflare says its own check can fail on a weak connection, with some ad blockers, or without JavaScript¹⁶, which can include people on a weak mobile signal.

Puzzles shut out more people still. A W3C note says CAPTCHAs, by their nature, exclude many people with disabilities, and suggests considering simpler measures such as a hidden field that only bots fill in¹⁷. If your form has one, test it on a phone with a bad signal, and see whether a lighter setting stops enough spam.

Ask for less

A form can work perfectly and still lose people. The W3C's advice is to ask only for what you need, because people are more likely to give up on a form that asks for more¹⁸. Name, a way to reply and the question is usually enough to start a conversation. Every field needs a visible label, and an error should say how to fix it. There's more on this in what to do about form abandonment.

Keep an eye on it

A test only shows the form worked today. If your contact page gets visitors every week and the messages suddenly stop, something broke. Nodium counts every form sent on your site, its own or any other except a search box, along with taps on your phone number and email address¹⁹. Its insights also flag a form question with no label a screen reader can announce²⁰. A week with no messages then shows up as a number you can check.