PHP is still the language behind a large part of the web. But adding a contact form to a PHP site doesn't mean you have to write a mail() handler, manage CSRF tokens, or configure SMTP credentials. This guide shows how to add a contact form to any PHP site — plain PHP, WordPress, or Laravel — by posting to a form backend instead.

The typical PHP approach and its problems

Most PHP contact form tutorials teach a pattern that looks roughly like this:

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name    = htmlspecialchars($_POST['name']);
    $email   = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
    $message = htmlspecialchars($_POST['message']);

    if ($email) {
        mail('[email protected]', 'Contact form', $message, "From: $email");
        header('Location: /thank-you');
        exit;
    }
}
?>

This works locally and in many shared-host scenarios, but in practice you end up owning:

SMTP configuration — mail() depends on the server's mail setup, which is often disabled on modern shared hosts or cloud platforms
Spam filtering — there is none in the example above; bots will find the endpoint
Reliable delivery — if mail() silently fails, the submission is lost
CSRF protection — the form above is vulnerable to cross-site form submissions without a token
Maintenance — any server migration requires reconfiguring everything

The alternative: HTML form + external endpoint

Instead of writing a PHP handler, use a standard HTML form in your .php template and point the action at a managed form endpoint. The PHP file renders the HTML — that's all it needs to do. The endpoint receives the POST, stores it, and handles notifications.

<?php /* contact.php — page template only, no form handling code needed */ ?>

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Contact</title>
</head>
<body>

<form action="https://myformconnect.io/f/YOUR_FORM_ID" method="POST">

  <label for="name">Name</label>
  <input id="name" name="name" type="text" required />

  <label for="email">Email address</label>
  <input id="email" name="email" type="email" required />

  <label for="message">Message</label>
  <textarea id="message" name="message" rows="5" required></textarea>

  <input type="hidden" name="_redirect" value="https://yoursite.com/thank-you" />

  <button type="submit">Send</button>

</form>

</body>
</html>

Using this in a Laravel Blade template

In a Laravel application, paste the form inside any Blade view. Because you're posting to an external endpoint (not a Laravel route), you don't need a CSRF token for the form itself — the endpoint handles authentication via the form UUID. There is no need to add a @csrf directive or a matching controller action for the form submission.

{{-- resources/views/contact.blade.php --}}

<form action="https://myformconnect.io/f/YOUR_FORM_ID" method="POST">
  <input name="name" type="text" required placeholder="Your name" />
  <input name="email" type="email" required placeholder="Email address" />
  <textarea name="message" required></textarea>
  <input type="hidden" name="_redirect" value="{{ url('/thank-you') }}" />
  <button type="submit">Send</button>
</form>

Reusing the form across multiple PHP pages

If you want the same form on several pages, extract it to a separate file and include it wherever it's needed:

<?php // parts/contact-form.php ?>
<form action="https://myformconnect.io/f/YOUR_FORM_ID" method="POST">
  ...
</form>

<?php include 'parts/contact-form.php'; ?>

In WordPress, use get_template_part('parts/contact-form') instead.

Security considerations

Your PHP page does not need to process any POST data — there is no user input to sanitise or escape in PHP
HTTPS on your domain is required for the browser to submit the form cross-origin
Enable spam protection on the endpoint to handle bots before they reach your dashboard
Never echo $_POST data elsewhere on the page without proper escaping

Migrating from an existing `mail()` handler

If you're replacing an existing PHP handler:

Create the form endpoint and configure email notifications
Update the action URL in the HTML form
Update the redirect after submission
Delete the old PHP handler file
Submit a test to confirm the new flow works

Keep field name attributes identical to your old form if you want historical exports from both periods to be comparable.

What changes and what stays the same

Replacing a PHP mail handler with an external endpoint is a small change to your form's action URL and a deletion of your old handler script. Your PHP templates, routing logic, and everything else stays exactly as it is. The form looks and behaves identically for visitors.

What you gain is a submission store that outlasts any mail delivery issue, built-in spam protection you don't have to write, and a notification setup that works reliably regardless of your server's mail configuration.

Ready to collect form submissions?

Create a free MyFormCapture form endpoint and skip building your own backend.

Start Free Trial

No credit card required · 5-minute setup

How to Add a Contact Form in PHP Without Building a Backend