Your WordPress contact form stopped sending and nobody told you
The form says 'message sent' whether the email arrives or not, so a broken contact form can sit quiet for months before anyone notices the enquiries stopped.
You filled in your own contact form last month to check something else and the email never turned up. Spam folder, nothing. You put it down to a slow server and got on with your day. Three weeks later a customer mentions they tried to get in touch and gave up.
The form told both of you the same thing: message sent. It was wrong both times.
The form lies to you by design
Most WordPress contact form plugins show the success message the moment your browser submits the form, before anyone has checked whether the email went anywhere. The plugin hands the message to the server and trusts it to deliver. Watching that handover and reporting back if it fails takes extra setup that hardly any site has switched on.
So the form works from where you’re sitting. Field validates, page refreshes, thank-you message appears. Everything after that happens out of sight, on the server, with nobody watching.
Why the email never arrives
Most WordPress installs send mail using a built-in PHP function that hands the message straight to the destination server and asks it to accept delivery. It doesn’t prove who it is. It doesn’t sign the message. It asks, and hopes to be believed.
Gmail, Outlook and BT Internet used to take that on trust. They don’t now. Every major mail provider checks whether the sending server is authorised to send on behalf of that domain before it accepts the message, and an unauthenticated request from a web host gets quietly dropped or filed as spam. No bounce, no error, no note back to your site. The message goes into a folder nobody opens, or nowhere at all.
Shared hosting makes it worse. Your website sits on a server with hundreds of others, and mail sent from that server carries the server’s reputation, not yours. If one of those other sites gets compromised and starts sending spam, mail providers mark the whole server as untrustworthy. Your form was fine. Your neighbour on the server wasn’t, and you both got treated the same.
This is not a fault your host will fix for you, either. Google and Yahoo tightened what they’ll accept from unauthenticated senders a couple of years back, and every provider that competes with them has followed the same direction since. A setup that limped through fine in 2020 can fail silently today with nothing on the server having changed at all. The bar moved under you.
How to test it properly
Checking the dashboard for errors won’t tell you anything, because there usually isn’t one. Test the actual path an enquiry takes:
Submit the form yourself, from a device you don’t normally use, to the address your enquiries should land in. Check the inbox and the spam folder both.
Use two different mail providers. A message that arrives at a Gmail address can still vanish on the way to Outlook, because each provider runs its own checks. Test with one of each if you can.
Look for the plugin’s own send log. WPForms, Contact Form 7 with a logging add-on and most of the well-built form plugins keep a record of what they tried to send, separate from whether it arrived. If the log shows an attempt but the inbox shows nothing, the problem sits between your server and the recipient’s, which points straight at authentication.
Do this once now, then put a reminder in your calendar to do it again in three months. A form that works today can stop the next time a hosting company changes its mail configuration, and you won’t get a warning either time.
The fix that holds
The reliable fix is to stop asking your web server to send mail on its own authority, and instead route it through a service that’s set up to prove it’s allowed to send on behalf of your domain.
That means two things, done once:
An SMTP connection through a proper sending service, rather than the server’s own bare-bones mail function. Plugins like WP Mail SMTP make this a form to fill in rather than anything you write yourself.
DNS records for your domain that name the sending service as authorised. These are called SPF and DKIM records, and they act as a signed letter of introduction: they tell Gmail and Outlook that when mail claiming to be from your domain arrives via that service, it’s genuine. Without them, every message is a stranger asking to be let in.
Setting this up takes about twenty minutes if you have access to your domain’s DNS settings, and it’s a one-time job. Once it’s in place, mail from your contact form arrives with the same reliability as mail from any properly run business, because as far as the receiving server is concerned, that’s exactly what it is.
What good looks like
A working setup gets a test submission into an inbox within seconds, not minutes. It shows up in the main inbox, not spam, on the first attempt, from any provider you test against. And if it ever does fail, something other than silence tells you: a failed-delivery notice, a log entry, anything other than an empty afternoon where the enquiries should have been.
Most site owners find out their form is broken from a customer who gave up and rang a competitor instead. That’s an expensive way to learn about a DNS record.
We check this as standard when we take over hosting for a site, alongside the updates and backups covered by Care & Hosting at £49 a month, migration free. If you’d rather check it yourself first, a free website review will tell you whether your form is one of the quiet ones.
