Skip to content
Menu

BlogGuides

Contact form on your website: why an email address alone isn't enough

Close-up of a hand typing on a laptop keyboard, with the blurred, overexposed screen in the background
Add as a preferred source on Google

One click, and Google will show my articles more often in your results.

Many small-business websites, especially the simpler ones, stop at an email address written at the bottom of the page, sometimes as a "get in touch" link, sometimes just as text to copy by hand. It looks like the most direct solution: nothing to configure, nothing that can break. For two reasons that don't show up until you go looking for them, it's also the choice that works worst.

The problem you don't see: addresses collected by bots

An email address published in plain text on a web page, whether as text or inside a "mailto:" link, is readable by anyone who scans the page's code, including the software that spam senders use to harvest addresses at scale: they search for exactly that pattern, "something@something.something," inside the HTML.

How much that can cost in practice was measured by Silvan Muhlemann in a 2008 experiment that's since become a frequently cited reference in technical circles: he published nine email addresses, each hidden from bots with a different technique while staying readable to a person, and counted the spam each one received over a year and a half. The address published with no protection at all collected over 1,800 spam emails, against zero for the three techniques that proved most effective. It's a personal experiment, never replicated, and it's nearly twenty years old: I'm not citing it as proof that the exact same thing would happen in the same proportion today, but as a demonstration that the mechanism (a readable address in the code of an indexed page gets found and used) is real, not a hypothesis. A contact form avoids this at the root, because the address messages actually go to never appears in code that a visitor, or a bot, can read.

Mailto doesn't work the same for everyone

There's a second problem, one that's obvious the moment you try it: a "mailto:" link doesn't open a page on the site, it opens the device's default mail program. Nielsen Norman Group flagged this back in 2000: a link, as far as anyone browsing is concerned, should show a page, not launch a different application by surprise.

Since then, a more practical problem has been added, one that more recent web development guides (from 2020 onward) document more precisely: if the device has no mail program configured, which happens more often than people think on a shared computer, on a centrally managed work computer, or for anyone who only uses webmail through a browser, the click leads nowhere useful. A form that opens on the page itself, and sends the message without leaving the site, avoids both problems: it doesn't depend on the navigation assumption a mailto link breaks, nor on what's installed on that device at that moment.

What a form does that an email address can't

Beyond avoiding these two problems, a form lets whoever builds it decide what information is actually needed before the first message even arrives: a name, a phone number, which service is of interest. With a plain email address, the content of the first message depends entirely on whoever writes it, and it often turns out something essential is missing, which means an extra round of emails just to get information a required field would already have collected.

A form can fail too, silently

That said, a form isn't a solution you install and forget. I've written before about a window and door company whose quote request form stopped sending emails without anyone noticing for weeks: the page kept showing the confirmation message, but nothing was arriving on the other end. It's a different risk from spam, but just as real, and the only way to rule it out is to check now and then that requests are actually coming through, rather than assuming a form that works today will keep working forever.

The two can coexist

Neither of these points means the email address should come off the site. Some people prefer to write on their own terms, maybe attaching a document or writing from a program they know well, and they should still be able to. The simplest solution is to keep both: the form front and center for anyone arriving from the site who wants the fastest path, the address still visible, perhaps in the footer, for anyone who specifically looks for it.

If your site's form has been live for a while and you can't remember the last time you checked that it actually works, get in touch and let's check it together: it takes a few minutes, not a project.

Frequently asked questions

Does a contact form really cut down on spam compared to a plain email address?

Yes, for a structural reason: an address written in plain text in a page's HTML, or inside a "mailto:" link, can be read and extracted by bots that crawl the web specifically looking for addresses, while a form doesn't publish the destination address anywhere in the page's code. A 2008 experiment by Silvan Muhlemann, who published nine addresses using different techniques and counted the spam each received over a year and a half, found that the address published with no protection at all collected over 1,800 spam emails, against zero for the three most effective techniques. It's a single personal experiment from almost twenty years ago, not a replicated study, but the mechanism it describes (bots read what's written in plain text) is still how automated address harvesting works today.

Why does a "contact me" link that opens an email sometimes not work?

Because a "mailto:" link doesn't open a page, it opens the device's default mail program, surprising anyone who expected to stay on the site: Nielsen Norman Group flagged this back in 2000 as a violation of the basic assumption people bring to browsing. There's also a more practical problem, documented by more recent web development guides (from 2020 onward): if the device has no mail program configured, which happens more often than people think on a shared computer, on a centrally managed work computer, or for anyone who only uses webmail through a browser, the click leads nowhere useful. A form, opening on the page itself, avoids both problems.

Should you remove the email address from the site entirely and keep only the form?

No, that's needlessly rigid. Some people prefer to write on their own terms, maybe attaching a file or writing from a mail client they know well, and they should still be able to. The simplest solution is to keep both: the form up front for anyone arriving from the site, the address still visible for anyone who specifically looks for it.

Can a contact form stop working without anyone noticing?

Yes, and it's just as real a risk as spam: a form can stop sending emails because of a botched update or a change in the mailbox's configuration, while whoever fills it in still sees the confirmation page and assumes the message went through. Anyone who doesn't check periodically that requests are actually arriving risks finding out only after weeks of lost inquiries.

How much does it cost to add a contact form to a business website?

A simple contact form, with the essential fields, is almost always already included in the base cost of a business website: it's one of the simplest features to build, not a separate line item. That changes if it needs to do something more complex, like routing requests to different addresses depending on the service chosen, or connecting to management software: in that case it's assessed case by case.

More articles

Is your website's contact form still sending requests?

Tell me about your project