The contact form is the most important single element on a small business website. Every dollar of marketing, every minute of SEO, every social post — all of it funnels here. Get the form wrong and the leads either bounce because the form is too long, fail to send because of a delivery problem, or get buried in a spam folder you check twice a year.
This post walks through the full setup: fields to include, fields to cut, spam protection that actually works, delivery routing, and the test you should run every Friday morning.
Step 1: Pick the right form builder for your stack
You have four reasonable options. Pick the one that matches your existing tools.
- Built-in form builder (Squarespace, Wix, Webflow, Showit). Use it if you are already on the platform. Limitations: less flexibility on logic, harder to integrate with CRMs.
- Tally (tally.so). Free, clean, fast. Best choice for most small businesses. Free tier covers unlimited forms and responses.
- Typeform (typeform.com). More polished, conversational style. Paid ($25/month).
- Formspree (formspree.io). Just receives form submissions from any HTML form. Best for custom-coded sites.
If you are on Skylift, we use Tally Pro by default for non-HIPAA forms and a custom encrypted form for any vertical that handles PHI.
Step 2: Decide on the right number of fields
The single biggest mistake on small business contact forms is too many fields. Every additional field cuts conversion by 7 to 10 percent on average. A 9-field form converts at roughly half the rate of a 4-field form.
The general rule: ask for the minimum information needed to qualify the lead and route them to a real conversation.
Bad (drops conversion 50 percent): name, email, phone, company name, address, job title, what services interest you, how did you hear about us, anything else we should know, are you ready to buy now or just researching.
Good (4 fields, high conversion): name, email or phone (pick one), what you need help with, when you need it done.
If you absolutely need more information, ask for it on the follow-up call, not the form.
Step 3: Field-by-field rules
The specific best practices for each field on a small business contact form.
- Name. Single field, not separate first/last. Less friction.
- Email or phone. Let the customer pick one or the other. Forcing both drops conversion. If you only get one, that is fine — most small businesses follow up by both anyway.
- What you need help with. Open-ended text box. Limit to 500 characters so spammers cannot dump 5,000 characters of garbage.
- When you need it done. Use a simple radio button or dropdown: ASAP, this month, next month, just exploring. This lets you triage hot leads in 5 seconds.
- Service of interest (optional, for businesses with 4+ services). Dropdown, not checkboxes.
- Honeypot field (hidden from humans, catches bots). See spam section below.
Skip these fields: address, company size, budget range, referral source. All of them can wait for the call.
Step 4: Add spam protection that actually works
Contact forms with no spam protection get destroyed by bots within 30 days. Two layers of protection work and do not annoy real users.
Layer 1: A honeypot field. A hidden form field that real humans never fill out (because they cannot see it) but bots fill in because they fill in every field. If the honeypot field has a value, the form silently rejects the submission. Almost every form builder has a built-in honeypot.
Layer 2: Cloudflare Turnstile or hCaptcha. Modern CAPTCHA alternatives that are invisible to most users. Skip Google reCAPTCHA — it adds significant page weight and slows your site, and Google recently changed its data handling in ways that make it less attractive for small business compliance.
Avoid these forms of spam protection.
- A "math question" CAPTCHA. Drops legitimate conversions.
- A "check the box" CAPTCHA. Annoying and dated.
- Requiring a phone number with country code. Drops legitimate Florida users who do not understand the format.
Step 5: Set up multi-destination delivery
Every contact form should send the submission to at least three places, not one.
- The owner's primary email (the one you actually check)
- A backup email (your business email, your spouse, your assistant — anyone who would catch it if you missed it)
- A CRM or spreadsheet (Airtable, Notion, Google Sheets, HubSpot — pick one)
The reason for three is that emails get lost. A spam filter eats one, an inbox rule routes another, a phone notification is missed. The third destination is your insurance policy. We have seen Florida small businesses lose 30 to 40 leads in a quarter because the single delivery email was being filtered to a folder nobody checked.
Step 6: Add an autoresponder
The customer who just sent you a contact form is at the highest commitment of their entire visit. They are also nervous (they just gave you their information). An autoresponder closes the loop and resets the trust clock.
A good autoresponder has four sentences.
- Thanks for reaching out (acknowledge receipt).
- Here is when you will hear back from a real human (specific time window: "within 4 business hours" or "by tomorrow morning").
- Here is one piece of information they probably want next (a pricing page, an FAQ, a calendar link).
- Sign-off with the owner's name and direct number.
Do not send a marketing email. Do not auto-add them to a newsletter. Acknowledge, set expectation, give them one useful next step, sign off.
Step 7: Test the form every Friday morning
This is the single highest-leverage habit any small business owner can build for their website. Every Friday morning, take 60 seconds to submit your own contact form with a real-looking test entry.
Use a real email and your phone number. Subject the message: "Friday test - [date]". Submit it.
Within 5 minutes you should see:
- The submission in your primary email
- The submission in your backup email
- The submission in your CRM or sheet
- The autoresponder in the email address you used
If any of these is missing, fix it before the next paid traffic dollar goes anywhere. We pulled a Reddit thread where a contractor said his form had been sending leads to an old email for 6 months and he had no idea. The 60 seconds on Friday saves you that scenario.
See our companion guide on testing the form for the deeper diagnostic.
Frequently asked questions
Should I include a phone number on the contact form, or rely on a separate "call" button?
Both. The contact form should have a phone field (optional, customer's choice). The site should also have a click-to-call phone link in the header and footer. Different customers prefer different paths.
What about a "Book a meeting" calendar widget instead of a contact form?
Add it as a secondary CTA, not the primary one. A contact form has lower commitment than a calendar slot. Some leads need the lower-commitment option first.
How long should the autoresponder take to send?
Under 30 seconds. If your autoresponder takes 10 minutes, you have a deliverability problem.
What if my form is getting too much spam?
Add Cloudflare Turnstile, shorten the message field to 500 characters, and add a honeypot. The three together stop 99 percent of bot spam without affecting real users.
Where should the contact form live on the site?
A dedicated /contact page, embedded on the homepage in the footer area, and on every service page near the bottom. Three placements minimum.
The honest answer
A working contact form is the difference between a website that generates leads and a website that just looks nice. The setup above takes 90 minutes and pays for itself with the first lead it would have lost otherwise. If you do not want to set it up yourself, every Skylift $499/mo plan includes the full form setup, spam protection, multi-destination delivery, and weekly automated form-test alerts.