Ask only what is needed to respond
For an initial contact, a name, contact method and short question are often enough. A tax identifier, detailed budget or long service selector is justified only if work cannot begin without it. Use visible labels, suitable input types and format guidance. A placeholder should not be the only label: it disappears while typing and makes review harder.
Validate on the server
Client-side validation helps the visitor but cannot replace server checks. Limit text length, validate contact details and escape rendered values. Add protection against repeated requests and spam while preserving keyboard access. An integration failure needs a saved enquiry or an explicit error, not a false success message.
Test the entire enquiry journey
Check successful delivery, empty fields, malformed data, double submission and a disconnected network. Preserve source and language without sending personal details to analytics. Agree retention periods and staff access.
- Clear labels and errors beside fields.
- Server protection beyond JavaScript.
- Verified delivery to storage or CRM.
- Notifications avoid personal-data exposure.
Project questions
Should every form have a CAPTCHA?
Not necessarily. Start with server validation, rate limiting and a hidden honeypot field. Introduce a harder challenge when an observed spam problem requires it.