How to Create a Contact Form on WordPress: The 2026 Step-by-Step Guide

To create a contact form on WordPress, install a form plugin such as WPForms or Contact Form 7, build the fields you need, then paste the form’s block or shortcode onto a page. The whole process takes about 10 minutes on a fresh site. The harder part, and the part most tutorials skip, is making sure the submissions actually reach your inbox instead of a spam folder.

We handle thousands of WordPress installs, and broken contact forms are one of the most common support tickets we see. So this guide covers the build, the delivery, and the spam filtering in one place.

The Fastest Method: A Form Plugin

WordPress ships with a Contact Form block in some themes, but it’s limited. A dedicated plugin gives you conditional logic, entry storage, file uploads and spam protection without touching PHP. Here’s the workflow, start to finish.

1. Install the plugin. In your dashboard, go to Plugins > Add New, search for your form plugin, click Install Now, then Activate.
2. Create a new form. Open the plugin’s menu item and choose the Simple Contact Form template. Most plugins pre-load name, email and message fields.
3. Adjust the fields. Drag in a phone field, a dropdown for enquiry type, or a checkbox for consent. Keep it to four or five fields; every extra field measurably reduces completion rates.
4. Set the notification email. In the form’s settings, point notifications to a real mailbox on your own domain and set the reply-to value to the visitor’s email field.
5. Write a confirmation. Choose either an inline thank-you message or a redirect to a dedicated thank-you page, which is far easier to track as a conversion.
6. Embed the form. Edit your Contact page, add the plugin’s block (or paste the shortcode), pick your form, and publish.

Test it immediately from a phone on mobile data, not just your desktop browser. Submitting from outside your own network catches caching and firewall issues you’d otherwise miss.

Which Contact Form Plugin Should You Use?

There’s no single best answer, but the shortlist has been stable for years. Each one suits a different kind of site owner.

• WPForms Lite is free, drag-and-drop, and the friendliest option for beginners. The paid tier adds entry storage and payment fields.
• Contact Form 7 is free with no upsells and is still active on millions of sites. You build forms by editing markup tags, so it suits people comfortable with a bit of HTML. Check the official plugin listing on WordPress.org for the current version and support forum.
• Fluent Forms is the lightweight pick, useful when you’re watching page weight on a marketing site.
• Gravity Forms is premium only and aimed at complex workflows: multi-page applications, CRM sync, conditional routing.

If you’re using Elementor, the free version no longer includes a form widget, so you still need one of the plugins above and then drop its shortcode into an Elementor Shortcode widget.

How to Build a WordPress Contact Form Without a Plugin

You can code a form yourself, and it’s worth doing on performance-obsessed sites where every kilobyte matters. The trade-off is that you own the security and the maintenance.

The pattern is straightforward: an HTML form in a page template, a nonce field for CSRF protection, a handler hooked to admin_post_nopriv, and sanitisation on every value before you pass it to wp_mail().

$name = sanitize_text_field( $_POST['your-name'] );
$email = sanitize_email( $_POST['your-email'] );
$msg = sanitize_textarea_field( $_POST['your-message'] );
wp_mail( get_option('admin_email'), 'New enquiry', $msg, array( 'Reply-To: ' . $email ) );

Put that code in a small custom plugin or a child theme’s functions file, never in the parent theme, or the next update will erase it. Teams that manage snippets like this properly usually run them through version control, which is why our Git-enabled WordPress hosting exists.

You’ll also need your own spam defence. A hidden honeypot field plus a simple time check (reject anything submitted in under three seconds) blocks a surprising share of bot traffic without a CAPTCHA.

The Step Everyone Skips: Making the Email Actually Arrive

Here’s the gap in most guides. WordPress sends mail through PHP by default, which means messages leave your server with no authentication and often no matching domain. Gmail, Outlook and Yahoo treat that as suspicious and quietly bin it.

Google and Yahoo tightened bulk sender rules in 2024, and enforcement has only got stricter since. The practical fix has three parts:

• Send through SMTP. Install an SMTP plugin and connect a proper sending service (Postmark, Mailgun, SendGrid, Brevo or Google Workspace). Transactional providers typically hit 98% or better inbox placement.
• Authenticate your domain. Add SPF, DKIM and a DMARC record in your DNS. The US Cybersecurity and Infrastructure Security Agency recommends all three as baseline email security.
• Never send from the visitor’s address. Set the From address to something on your own domain, like forms@yoursite.com, and put the visitor’s email in Reply-To. Spoofing the sender is the single biggest cause of failed delivery.

Turn on entry storage in your form plugin as a safety net. If email breaks for a week, you’ll still have every enquiry sitting in the database rather than lost forever.

Cutting Spam Without Wrecking Conversions

An unprotected contact form on a public page will start collecting junk within days. Layer your defences rather than relying on one:

• Honeypot field (invisible to humans, irresistible to bots): free, zero friction, stops maybe 60 to 80% of automated submissions.
• Akismet or a similar filter to score submissions against known spam patterns.
• Cloudflare Turnstile or hCaptcha instead of Google reCAPTCHA v2 if you want to avoid puzzle-solving friction.
• Country or keyword blocking for the persistent SEO-pitch spam that gets through everything else.

Skip visible CAPTCHAs on low-traffic sites. They cost real conversions, and a honeypot plus Akismet usually handles the volume fine.

Where Should the Contact Form Go?

The form lives wherever you place its block or shortcode, so a dedicated Contact page is the obvious home. But that page is rarely the only place people want to reach you.

We generally suggest three placements: the main Contact page, the footer of every page (a compact two-field version), and the bottom of your highest-intent service pages. Keep the URL short and memorable, which is easy enough if you set up a vanity URL in WordPress like yoursite.com/talk.

Some visitors won’t fill in anything at all. Pairing the form with live chat on your WordPress site catches the people who want an answer in the next 30 seconds.

Performance, Privacy and Tracking

Form plugins are heavier than they look. Many load their CSS and JavaScript on every page of the site, not just the page with the form. Most decent plugins now include an option to load assets only where a form is present, and turning it on can shave 100 to 300ms off unrelated page loads.

On the privacy side, add a consent checkbox that links to your privacy policy, and set an entry retention period (90 to 365 days is common) if you store submissions. That keeps you honest under GDPR and similar rules.

Then measure. Watching form views against completions tells you whether a field is scaring people off, and built-in hosting analytics make that visible without bolting on another tracking script. Sites handling serious enquiry volume tend to move to business-grade WordPress hosting for the resources and support response that comes with it.

If your contact page loads slowly even after all this, the bottleneck is probably server-side rather than the form. A WordPress performance audit will tell you where the time is actually going.

Frequently Asked Questions

How to create a contact form?

Install a form plugin, pick the simple contact template, set your notification email, then add the form’s block or shortcode to a page: about 10 minutes total. The only extra step worth doing is configuring SMTP so the notification emails reliably reach your inbox.

Which contact form is best for WordPress?

WPForms Lite is the best free starting point for most people, while Contact Form 7 suits anyone comfortable editing markup and Gravity Forms fits complex, multi-step workflows. All three are actively maintained and have been in the WordPress ecosystem for over a decade.

How do I create a fillable form in WordPress?

Any form plugin creates fillable forms, supporting text inputs, dropdowns, checkboxes, date pickers, file uploads and signatures depending on the tier you’re on. For fillable PDFs specifically, you’ll need a separate PDF add-on that maps submitted entries onto a template document.

Where does the WordPress contact form go?

Wherever you place the block or shortcode, though a dedicated /contact page plus a compact footer version covers most visitors. Submissions go to the notification email you set, and to the plugin’s entries database if storage is enabled.

Do I need a plugin to add a contact form?

No, you can build one with roughly 40 lines of PHP using wp_mail() and a nonce, but you take on the security and spam handling yourself. A plugin is the sensible choice unless you have a specific performance or compliance reason to avoid one.

Want Your Forms to Deliver Every Time?

Contact forms only pay off when the messages land, and that depends as much on your host’s mail configuration and uptime as on the plugin you picked. Talk to our WordPress specialists at WebVibo about moving your site to a platform where deliverability, caching and security are already sorted.