Protect enquiry forms without blocking customers

Start with server-side validation, rate limits and a hidden honeypot field. Check length and format, but accept international names and contacts. Front-end validation alone is easy to bypass.

Save a legitimate enquiry before trying to send notifications. Log delivery status separately so a mail outage does not erase the request. Avoid putting full message contents into public error logs.

Use stronger challenges only when simpler controls prove insufficient. Test keyboard navigation and phone input after every change. A form that blocks customers has defeated its own purpose.