Forms and delivery · Beginner · 30 minutes end to end
How to create a contact form — Two Things to Prove: It Arrives, and It Is Not on Every Page
The form says thank you, the entries are piling up in the database, and you have no evidence that a single notification email ever left the server.
The short answer
Prove delivery to an external address before you go live, then check what the plugin loads on pages with no form on them. Those are the two ways a contact form fails: notifications that vanish silently because the site is sending through PHP mail rather than authenticated SMTP, and a form plugin enqueueing its stylesheet and script across every page on the site.
Both are quick to settle. A single test submission to an address on another provider, with the plugin's own send log open, answers the first. The DevTools Network panel on a page that contains no form answers the second. Everything else — field count, spam handling, the reply-to header — follows from those checks.
By the HostingFast team · Reviewed 24 August 2026
Beginner
Assumed skill
30 minutes
Time at the keyboard
5
Stages in the runbook
24/7
Engineers on shift
Thirty minutes, one form, and two verifications you should not skip. This assumes you can read a network waterfall and open a second mailbox on a different provider, which is all the tooling required.
The measurement here is not a score, it is a pair of yes/no answers: did the mail arrive somewhere you do not control, and does the form's payload appear on pages that have no form. Neither can be answered from the WordPress admin.
Send through SMTP, then prove it left the building
PHP's mail function hands the message to whatever the server has configured and reports success regardless of what happens next. Authenticated SMTP to a real mailbox on your own domain gives the message a legitimate envelope sender, which is what receiving servers check, and it gives you a send log to read when something goes missing.
Then test to an address on a completely different provider, not to your own domain. Delivery to yourself frequently succeeds through paths that fail for everyone else. Check the received headers on the delivered message, and confirm the plugin's log shows a successful handoff rather than an optimistic tick.
Check what the plugin loads on pages with no form
Open a page with no form on it — a blog post, the homepage — and look at the Network panel. Many form plugins enqueue their CSS, their JavaScript and sometimes a validation library globally, so a two-field contact form adds weight to all two hundred pages of the site.
Most of the serious plugins have a setting to load assets only where a form is present, or to declare which pages need them. Turn it on, reload, and confirm the requests disappeared. This is a one-setting change with a site-wide payload saving, which is a better ratio than almost anything else on this list.
Spam defences that cost the visitor nothing
A honeypot field and a minimum time-to-submit check are both invisible, both server-side and both free in payload terms. They stop the overwhelming majority of automated submissions. Start there, and only escalate under a genuine flood — because the escalation has a price.
That price is measurable: a third-party challenge widget is another script, another connection and another chunk of main-thread work on the page carrying your enquiry form. Protection that costs real enquiries and real milliseconds is mispriced unless the spam is actually arriving in volume.
The two small settings that make replies work
Set the notification's reply-to header to the enquirer's address. Hitting reply then reaches the customer directly rather than sending your answer to yourself, which is where the copy-paste mangling of addresses comes from. Keep the from address on your own domain so the message passes authentication checks.
Then submit one real test and watch both messages: your notification and the sender's confirmation. Two emails, two inboxes, seen with your own eyes. Mailboxes on your own domain are included with the plan, and every one of them carries spam and virus screening as standard, so the receiving half is already handled.
The mail path these tests ran through
Mailboxes on your own domain are part of the plan, with the exact SMTP host and port shown on the panel's mail-client settings page — so the authenticated send path this runbook depends on is available without buying anything extra.
Human support is on duty every hour of every day, and the scope covers exactly this kind of practical question rather than bouncing it back to you.
- Mailboxes on your own domain, included with the plan
- Spam and virus screening on every mailbox as standard
- SMTP details published in the panel, no guesswork
- Engineers who will read a mail log with you at any hour
Why HostingFast
Standard on every plan
Delivery proven, not assumed
A test to a mailbox on another provider, with the send log open, which is the only evidence that counts.
Payload checked site-wide
You verify what the form plugin loads on pages that contain no form, and switch off the ones that should not be there.
Authenticated sending path
SMTP through a mailbox on your own domain gives the message an envelope sender receiving servers will accept.
Spam handling with no script cost
Honeypot and timing checks first, both invisible and weightless; a challenge widget only if the flood is real.
Replies that go to the customer
One reply-to header removes the copy-paste step where half of all first responses get mangled.
Both messages witnessed
Notification and confirmation, two inboxes, checked by hand before the form goes anywhere near a live page.
Quick Start
From order to online
- 1
Pick a plugin that logs its sends
Saved entries and a visible send log matter more than the builder interface. Without a log, a missing notification is unfalsifiable.
- 2
Wire it to authenticated SMTP
Send through a mailbox on your own domain using the host and port from the panel's mail-client settings page. Never leave it on the PHP mail function.
- 3
Test to a different provider
One submission to an address you do not host, then read the received headers on arrival. Delivery to yourself proves considerably less than it appears to.
- 4
Cut the fields, then cut the assets
Name, email, message. Then load a page with no form and confirm in the Network panel that the plugin's CSS and JS are no longer being enqueued.
- 5
Set reply-to and check both messages
Reply-to as the enquirer, from address on your domain. Submit once more and confirm your notification and their confirmation both landed.
Built In
Loaded onto every plan
- Email addresses that run on your own domain name
- Spam and virus screening on every mailbox as standard
- Browser webmail plus IMAP, POP and SMTP for any mail app
- NVMe SSD storage on every tier, including the entry plan
- LiteSpeed caching compiled into the server, not bolted on by plugin
- Per-site PHP version switching from the control panel
- Staging environments for rehearsing a change before it ships
- Daily backups on every plan, with restores you run yourself from the panel
- Free SSL on every plan, reissued automatically before it can expire
- Human support on duty every hour of every day
Frequently Asked
What people ask us most often
Is the form plugin loading its CSS and JavaScript on pages with no form?
Very often yes, and it is worth ten seconds in the Network panel to find out. Load a page with no form and look for the plugin's assets; if they are there, switch on its conditional or per-page asset loading and confirm the requests disappear. One setting, and the saving applies to every page on the site.
How do I prove a notification actually left the server?
Send to a mailbox on a provider you do not control, then read the received headers on the delivered message and cross-check the plugin's own send log. A form that reports success while sending through the PHP mail function can drop messages for months without a single error surfacing anywhere in the admin.
Is a challenge widget worth its payload on a contact form?
Only once the spam is genuinely arriving. A honeypot field plus a minimum time-to-submit check are invisible, server-side and free in bytes, and they stop most automated traffic. A third-party challenge adds a script, a connection and main-thread work to the page you most want people to complete.
Where do I find the SMTP host and port for a mailbox on my domain?
The panel's mail-client settings page lists them per mailbox, along with the secure ports, so there is nothing to guess at. Mailboxes on your own domain come with the plan and carry spam and virus screening as standard, which means the authenticated send path this runbook relies on needs no extra purchase.
Keep reading
How to Change Your PHP Version
Move a site onto a newer PHP release and measure the difference in response time rather than assuming it — beginner, roughly 10 minutes.
WordPress SEO First Steps
The technical groundwork that lets a new site be crawled, rendered and indexed properly — beginner, roughly an hour.
DNS (Domain Name System) (Glossary)
The lookup layer behind every mail record, and what a wrong one costs you in delivery.
WordPress Hosting
WordPress on LiteSpeed and NVMe, with staging clones and daily backups included.
Charity Hosting
Discounted hosting for charities and nonprofits, with nothing essential stripped out.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Send from a mailbox you own.
Mailboxes on your own domain with spam screening included, NVMe behind a LiteSpeed cache, and support on shift at any hour.
View WordPress Hosting plans