Skip to content
GPLWP Guides

How to create contact forms in WordPress

Forms Time About 20 minutes 6 steps Updated 8 Nov 2026

FORMS
The short answer

Self-hosted WordPress does not include a general-purpose contact form builder, so you need either a form plugin or custom code. A plugin is the practical route for most sites because it handles fields, validation, spam protection and email notifications without maintaining a form handler yourself.

The route
  1. 01Plan the information you need
  2. 02Choose the manual route
  3. 03Install and create the form
  4. 04Configure email and spam settings
  5. 05Add it to a page
  6. 06Submit a real test message

What you need

  • A WordPress site with administrator access
  • An email address on your site’s domain for notifications
  • Your hosting or email provider’s SMTP details if WordPress email delivery is unreliable

Plan the information you need

Keep the first form short. Most contact forms need a name, email address, message and submit button. Add a phone field, enquiry type or consent checkbox only when you have a clear reason to use it.

Decide where submissions should go and what visitors should see after submitting. Use a domain-based sender address where possible, rather than setting the visitor’s email address as the sender.

Choose the manual route

On self-hosted WordPress, the manual route means building the HTML form and writing the server-side handler yourself. The handler must validate and sanitise submitted values, include a WordPress security nonce, check that the request is valid, and send the message through wp_mail(). WordPress documents nonce creation and verification through functions such as wp_nonce_field() and check_admin_referer().

This is reasonable for a developer who needs a very specific form, but it is not just a matter of pasting an HTML form into a page. You also need to handle errors, redirects, spam, accessibility, storage or deletion of submissions, and email delivery. A mistake in the handler can expose submitted data or make the form appear to work while sending nothing.

Install and create the form

For the usual route, install a reputable form plugin from Plugins → Add New, activate it, and create a new contact form. Add the fields you planned, mark essential fields as required, and set a clear success message.

Use a template if the plugin provides one, then remove fields you do not need. Fewer fields usually means fewer abandoned submissions and less personal data to manage.

Configure email and spam settings

Set the notification recipient to the address that should handle enquiries. Use an address on the same domain as the website for the sender when the plugin allows it, and put the visitor’s address in the reply-to field. This helps avoid authentication and spoofing problems.

Enable the plugin’s honeypot or CAPTCHA option, and configure a privacy or consent field if you collect personal information. WordPress email uses wp_mail(), but a successful hand-off does not guarantee that the message reaches the inbox. SMTP and domain email settings may be needed.

Add it to a page

Create or edit a Contact page and insert the form using the plugin’s block, shortcode or page-builder widget. Add a short explanation above it, including the expected response time and an alternative contact method if the enquiry is urgent.

Check that the form is visible on mobile and that labels, required-field messages and keyboard focus are clear. Do not rely on placeholder text as the only field label.

Submit a real test message

Send a test from a different email address, then check the destination inbox, spam folder and the form plugin’s submission area if it stores entries. Confirm that the notification contains the visitor’s details and that the reply-to address works.

If no email arrives, first confirm the notification address and check spam. Then test WordPress email delivery separately and configure SMTP or a transactional email service if required. Email logs can show whether WordPress attempted to send the message; contact-form plugins generally trigger the email, but delivery still depends on the site’s mail system.

For the fast way, use HappyForms Pro Contact Form Builder. Its drag-and-drop builder, templates, conditional logic, spam protection and email integrations let you create the form without writing and maintaining a custom submission handler.

The fast route

Let HappyForms Pro Contact Form Builder do it

Drag-and-drop builder with templates, conditional logic, spam protection, and email integrations for flexible WordPress forms.

Get HappyForms Pro Contact Form Builder

Sources

  1. developer.wordpress.org /apis/security/nonces/?utm_source=openai
  2. developer.wordpress.org /reference/functions/wp_mail/?utm_source=openai
  3. wordpress.com /support/plugins/troubleshoot-plugin-emails/?utm_source=open…

Questions

Does WordPress include a contact form by default?
No, self-hosted WordPress does not include a general-purpose contact form builder in its core editor. You can code a form and its server-side handler yourself, but that requires validation, security checks, spam controls and email handling. For most site owners, installing a maintained form plugin is safer and quicker. Some hosted WordPress services provide their own form block, so the available options depend on your hosting platform.
Why is my WordPress contact form not sending emails?
The form may be submitting correctly while WordPress email delivery is failing. Check the notification address, spam folder and the plugin’s stored submissions first. Then test site email and review any mail logs. Many sites need SMTP or a transactional email service because <code>wp_mail()</code> only reports that the message was handed to the mail system, not that it reached the recipient.
Should the visitor’s email address be used as the sender?
Usually no. Set the sender to a valid address on your website’s domain and place the visitor’s address in the reply-to field. Using a visitor-controlled address as the sender can fail domain authentication or look like spoofed mail to receiving providers. It can also make replies unreliable when the submitted address is mistyped.
Do contact forms need spam protection?
Yes, even a simple contact form should have some spam control. Start with a honeypot field or the plugin’s built-in anti-spam option, then add CAPTCHA if unwanted submissions continue. Keep an eye on stored entries as well as email, because spam can fill the database even when notifications are filtered. Do not use a CAPTCHA as a substitute for validating submitted data.
Can I create a contact form without a plugin?
Yes, but you need custom development rather than just an HTML block. The form must post to a handler that validates and sanitises input, verifies a WordPress nonce, sends or stores the submission, and returns a useful success or error response. You also have to maintain that code when WordPress, PHP or your email provider changes, so a plugin is normally the faster route.