Build Lightweight Custom Contact Form with Spam Protection Without Form Plugin

Contact form plugins are often a major source of site bloat, loading unnecessary CSS and JS on every page of your site. Building a custom form is simpler than you think and significantly faster.

Why go custom?

Core Concept: The Honeypot

A honeypot field is a hidden input field that a human user won't see or fill out. A bot scanning your form will happily fill in every field! If the honeypot field is filled, you simply reject the submission.

<!-- Hidden field in your form -->
<p class="hidden-field" style="display:none;">
    <label>Leave empty</label>
    <input type="text" name="honeypot" />
</p>

// PHP check on submission
if (!empty($_POST['honeypot'])) {
    wp_die('Bot detected!');
}

1. The HTML Form

Add this to your template file (e.g., `page-contact.php`):

<form action="" method="post">
    <input type="text" name="user_name" placeholder="Name" required />
    <input type="email" name="user_email" placeholder="Email" required />
    <textarea name="user_message" placeholder="Message"></textarea>
    
    <!-- Honeypot -->
    <p style="display:none;">
        <input type="text" name="honeypot" />
    </p>
    
    <input type="submit" name="submit_form" value="Send" />
</form>

2. The PHP Handler

Add this to your `functions.php` file to handle the form processing:

add_action('init', 'process_my_contact_form');
function process_my_contact_form() {
    if (isset($_POST['submit_form'])) {
        // Honeypot check
        if (!empty($_POST['honeypot'])) return;

        // Sanitize and process data
        $name = sanitize_text_field($_POST['user_name']);
        $email = sanitize_email($_POST['user_email']);
        $message = sanitize_textarea_field($_POST['user_message']);

        // Send email
        wp_mail('your-email@example.com', 'New Contact Form Message', $message, array('Reply-To: ' . $email));
    }
}