Your site is live, but visitors can only reach you through an email address in the footer. Time for a contact form. That sounds like ten minutes’ work, and the form itself does take ten minutes to set up. The real work lies in what you don’t see: making sure every message sent actually arrives in your inbox, and that your inbox doesn’t get flooded with spam. A form that quietly loses messages is worse than no form at all, because you’ll think everything is fine while customers are waiting for a reply. Unfortunately, we see this happen quite often. That’s why we treat the entire process as a single unit: building the form, blocking spam, ensuring delivery, and testing.
Step 1: Choose a form plugin
WordPress doesn't have a built-in contact form, so you'll need to use a plugin (an extension that adds functionality). There’s a huge selection, but in practice, you’ll keep coming across the same names. Contact Form 7 has been the free standard for years: simple and reliable, but you build the form using code in a text field, which can be daunting for beginners. WPForms and Fluent Forms feature a visual builder where you can drag and drop fields, with free versions that are more than sufficient for a simple contact form. If you’re using the Elementor page builder, the paid version includes an excellent built-in form widget.
Our advice: For a standard contact form, choose a plugin with a visual builder, such as Fluent Forms or WPForms. It saves you the trouble of figuring things out, and the settings for notifications and spam are clearly organized. Install the plugin via Plugins > Add New, activate it, and open the new menu item.
Step 2: Create the form, and keep it short
Every form plugin comes with a ready-to-use contact form template as a starting point. We’re very clear about the fields: less is better. Name, email address, and message are enough for most sites, possibly supplemented with a phone number as an optional field. Every additional required field demonstrably reduces the number of submissions; people are put off by long forms. Ask only for what you need to be able to respond.
Next, set up the notifications: the email address where you’ll receive submissions, and an on-screen confirmation message for the visitor (“Thank you, we’ll respond within one business day”). Next, add the form to your contact page using the block or shortcode (a short code enclosed in square brackets that the plugin generates for you) provided by the plugin. To learn how to set up that contact page yourself and add it to your menu, read our A Beginner's Guide to Creating a Website with WordPress.
Step 3: Turn on a spam filter before the spam arrives
An unprotected form will be discovered by spambots within a few weeks, and then you’ll start receiving fake messages every day. So set up protection right away—don’t wait until things go wrong. The most user-friendly measure is a honeypot: an invisible field that real visitors never fill out but bots do, after which the submission is quietly rejected. Most form plugins have this enabled by default. If spam still gets through, add reCAPTCHA or the more privacy-friendly Cloudflare Turnstile: a verification system that distinguishes bots from humans, which these days usually runs invisibly in the background. Our order of preference: use a honeypot first, and only implement a visible check if it’s truly necessary, because every additional hurdle also costs you legitimate submissions.
Step 4: The step everyone skips: delivery via SMTP
This is where things most often go wrong in practice. By default, WordPress sends email using a method that originates from the web server itself, without proper authentication. Email providers like Gmail and Outlook are becoming increasingly wary of such emails: your form messages end up in the spam folder or are rejected, without you or the visitor even noticing. The solution is to send emails via SMTP (the standard protocol for outgoing email), which allows your site to send emails securely through a real mail server.
To do this, install an SMTP plugin such as WP Mail SMTP or FluentSMTP and enter your mail server details: server, port, username, and password for a mailbox on your own domain. Have the form send emails from an address on your own domain (such as site@jouwdomein.nl) and put the visitor’s address in the “From” field; sending emails “on behalf of” the visitor’s address is exactly what spam filters flag as suspicious.
At Surver: You can find the SMTP settings for your email accounts in your hosting control panel, and our support team is available seven days a week to help you set them up if you're having trouble.
Step 5: Test, and then repeat occasionally
Test the form from start to finish: fill it out as a visitor, check whether the confirmation appears on the screen, and whether the message arrives in your inbox—including outside the spam folder. Then send a test message to an address with a different provider (for example, a Gmail address if you use your own domain for email), since delivery can vary by provider. And make it a habit to repeat this every few months: a plugin update or a change in email settings can disrupt delivery without you noticing. Fortunately, many form plugins also store submissions in the database (your site’s storage), so if in doubt, you can check the dashboard to see what was sent. Those stored submissions are yet another reason to keep your backups in order; you can read about how to set that up in our A Complete Guide to WordPress Backups and Migration.
At Surver: With our managed plans, we take care of updating your plugins—including your form and SMTP plugins—so that your contact flow doesn't quietly break after an update.
One reliable contact flow
A good contact form is therefore not a standalone widget but a chain: a short form, a silent spam filter, authenticated submission, and periodic testing. Once that chain is in place, you won’t have to worry about it anymore in practice. The form thus simply becomes one of the components you include in your site’s regular maintenance; you can read about what that overall maintenance entails in our A Complete Guide to WordPress Management.
