Blog Contact Forms: GDPR-Friendly and Spam-Free
A contact form is the most personal data most blogs ever collect. Here is how to run one that asks for little, keeps it briefly, stops spam without a tracking script, and still reaches your inbox.
A GDPR-friendly blog contact form asks only for what you need to reply (usually a name, an email and a message), says why, keeps submissions for a fixed period and then deletes them, and stops spam with server-side checks rather than a tracking script. Running the form on your own server keeps the messages in your own database.
A contact form looks like the smallest feature on a blog, and it is usually the most personal data the blog ever collects: a real name, a real email address, and whatever someone chose to tell you. It is also the page spam bots find first. Most blogs solve both problems by bolting on a plugin or embedding a hosted form service, which adds another company that receives your readers' messages. You can do better with less.
What a contact form actually collects
Under the GDPR every field is personal data you are responsible for, so start with the shortest form that lets you reply. For most blogs that is three fields: a name, an email address, and a message. Each extra field (phone, company, a dropdown about budget) needs a reason you could explain to the person filling it in. Data minimisation is not a formality here; it is the easiest compliance work you will ever do, because data you never collect cannot leak, be requested, or need deleting.
Tell people what happens next in one sentence above the button ("we use this to reply to you and keep it for 12 months") and link your privacy notice. Our self-hosted blog GDPR checklist covers the notice itself.
Where the messages go
This is the part people skip. With a hosted form service, every submission is stored on that company's servers first and emailed to you second, so the service becomes a processor you need to name, and possibly a transfer outside your region. With a typical plugin setup, messages often go straight to email and live forever in a mailbox nobody audits.
A form that saves to your own database, on a server you chose, keeps the data where the rest of your blog's data already is. You can still be notified by email; the difference is that the inbox is a copy, not the only record, and the stored copy can be searched, exported and deleted on a schedule.
Keep submissions for a fixed time, then delete them
"How long do you keep it?" is the question most small sites cannot answer. Pick a period that matches why you collect messages, write it in your privacy notice, and make the deletion automatic so it does not depend on remembering. Twelve months is a common choice for general enquiries; shorter is fine if you reply within days.
Stopping spam without a tracking script
A CAPTCHA is the reflex answer, but the common ones load a third-party script that profiles the visitor, which then needs disclosing and sometimes consent. For a blog, server-side checks stop most automated spam on their own:
- A honeypot field that people never see and bots fill in.
- A signed timing token, so a form submitted faster than a human can type is rejected.
- Content limits: no markup, and only a couple of links per message.
- Rate and repeat limits: a few messages per address per hour, and no identical message twice.
- A silent "sent" reply to spam, so bots learn nothing about which check caught them.
These are the same checks that work for comments, which we cover in more depth in self-hosted blog comments.
How Inkwell handles contact forms
Since v1.0.9, Inkwell builds contact forms in the admin (Admin, then Forms) and places them on any page with the Form block. A new form starts as a ready-made contact form, with name, email, short text, long text, choice list, checkbox and consent fields available, up to 20 per form. The form renders in your theme and works without JavaScript; with JavaScript it sends in place and shows each error at its field.
- Spam: every submission passes the comment spam checks above (honeypot, signed timing token, no markup, at most two links, no repeats within 30 days, at most five per address an hour). Spam gets the same "sent" reply, is not stored, and is reported to the IP firewall.
- Retention: each form sets how long submissions are kept, 365 days by default, and older ones are deleted every night.
- Privacy: the sender's IP address is stored only as a keyed hash, used for the rate limit.
- Getting the messages: submissions are listed per form with search, can be downloaded as CSV, emailed to an address you choose with Reply-To set to the visitor, and sent to webhooks as the
form.submittedevent. The submission is saved before the notification email is sent. - Control: managing forms and submissions is Admin-only and audited, and forms are included in site backups.
Setup is in the Inkwell documentation.
The best contact form asks for three things, keeps them for a known time, and never sends your readers' words to a company they did not choose.
Frequently asked questions
Does a blog contact form need a consent checkbox under GDPR?
Not always. If you only use the details to reply to the message, the lawful basis is often legitimate interest or the person's own request, and a clear notice is enough. Consent matters when you want to do something more, such as adding the person to a mailing list. This is general information, not legal advice.
How long should I keep contact form submissions?
Only as long as you need them to deal with the enquiry, and for a period you state in your privacy notice. Twelve months is a common choice. Make deletion automatic: Inkwell, for example, deletes submissions older than each form's retention period every night, 365 days by default.
How do I stop contact form spam without a CAPTCHA?
Use server-side checks: a hidden honeypot field, a signed timing token that rejects instant submissions, limits on links and markup, and per-address rate limits. Together they stop most automated spam without loading a third-party script that profiles your visitors.
Can Inkwell send contact form submissions to other tools?
Yes. Since v1.0.9 each submission can be emailed to an address you choose, downloaded as CSV, and sent to any webhook endpoint as the signed form.submitted event, so you can route enquiries to a help desk or chat tool.
Ready to host your own blog?
Inkwell is free, open-source, and self-hosted — your content, your server, your rules. Deploy in minutes on .NET 10.