---
title: "Contact form and messages"
description: "Add Éclair's contact form, block spam without a captcha, get email notifications and manage the Messages inbox, with the GDPR covered too."
url: "https://eclair.academy/en/paths/beginner/contact-form"
lang: "en"
author: "Thierry Gustin"
published: "2026-11-02"
updated: "2026-11-02"
---

# Contact form and messages

> **Key takeaways** — Éclair's contact form is added with the block of the same name and blocks spam without a captcha, thanks to a honeypot field, a token and limits of 5 messages per network every 10 minutes and 100 per day for the site. Messages arrive by email and in the Messages inbox, capped at 500.

Éclair's contact form lets you receive your visitors' requests with no captcha and no external service. In this lesson, you add it to a page, understand how it blocks spam, set up email notifications and manage the Messages inbox, without forgetting the GDPR.

> **Before you start** — Time: 15 minutes. Prerequisites: know how to insert a block ([Write and publish your first blog post](https://eclair.academy/en/paths/beginner/first-article)) and edit a page ([Pages, menus and home page](https://eclair.academy/en/paths/beginner/pages-menus-home)). Keep your mailbox open for the final test.

## What you'll be able to do

### ✉ Receive requests

Add the form and get each message by email.

### 🛡 Block spam

Understand the captcha-free protections and test without locking yourself out.

### 💬 Reply fast

Sort, read and answer from the Messages inbox.

## Add the contact form to a page

The **Contact** page created during installation already contains the form, and the Landing page site type also places one at the bottom of the home page. To add one elsewhere, for example on Atelier Nova's “Classes” page:

1. Open the page in the editor, go to an empty line and type **/**.
2. Choose **Contact form**, described as “Built-in anti-spam form”.
3. If you like, fill in **Section title (optional)**, for example “Book a trial class”, and **Button text (optional)**. Without text, the button reads “Send”.
4. Click **Publish** or **Update**.

On your site, visitors see three fields, **Name**, **Email** and **Message** (5,000 characters at most), then the notice “Your data is only used to reply to you.”, followed by a link to your privacy policy. After sending, a confirmation message appears in the form, without reloading the page.

## How does the form block spam without a captcha?

| Protection | What it does |
| --- | --- |
| Honeypot field | A field that humans can't see. A bot that fills it in thinks its message was sent, but Éclair keeps nothing. |
| Token | Added by the browser when the visitor uses the form. Without a valid token, the message is marked “Likely spam” and isn't sent by email. |
| Links | A message with more than 3 links is marked “Likely spam” and cut to 1,000 characters. |
| Per-network limit | 5 messages every 10 minutes per network (an IPv4 address, or a /64 block in IPv6). Beyond that, the network is blocked for 30 minutes. |
| Site limit | 100 messages per day for the whole site. Beyond that, the form is blocked for 6 hours. |
| Origin | Submissions coming from another site are refused. |

The result: no box to tick or images to identify for your visitors, and no third-party service tracking them.

> **Test without locking yourself out** — During your tests, beyond 5 messages in 10 minutes from your connection, the form replies “Sending failed. Check the fields and try again.” for 30 minutes. It's not a fault: an administrator can lift the block in **Security › Sessions and blocks**, with the **Unblock** button.

## Manage the Messages inbox

![Messages inbox with the messages received through the form and their Reply button](https://eclair.academy/media/2026/11/eclair-academy-messages-en.webp)
*Messages: everything your form has received*

Click **Messages** in the menu: the number of unread messages appears next to it, and the dashboard repeats it under **Unread messages**. Each message shows the name, email, date and the page it was sent from.

- **Reply** opens your email app with the visitor's address and the subject “Re:” followed by your site's name.
- **Read** marks the message as handled.
- The trash icon deletes it, after confirmation.
- Suspicious messages carry the **Likely spam** badge and don't count as unread.

The inbox shows 20 messages per page, with **Newer** and **Older** to navigate. It's capped at 500 messages: beyond that, the oldest are deleted, spam first.

## Set up email notifications

Open **Settings › Contact** (administrators only):

| Setting | Role | Default |
| --- | --- | --- |
| **Receive messages at** | The address that receives each message | The first administrator's email |
| **Also keep messages in the admin** | A copy in **Messages**, even if the email gets lost | On, and recommended |
| **Confirmation message** | The text shown to the visitor after sending | “Thank you! Your message has been sent.” |

![Contact settings tab with the receiving address, message storage and the confirmation message](https://eclair.academy/media/2026/11/eclair-academy-settings-contact-en.webp)
*Settings › Contact: where your messages arrive*

Each message reaches you with a subject such as “[Atelier Nova] New message from Julien”, sent from `no-reply@atelier-nova.fr`. The visitor's address is set as “Reply-To”: clicking **Reply** in your email app writes straight back to them.

## Why aren't the emails arriving?

1. Look in your email app's spam folder.
2. Check the address entered in **Settings › Contact**.
3. Check the **Official site URL** in **Settings › General**. Éclair sends its emails from the server, with the address `no-reply@` followed by that domain, and some hosts require the sender to belong to the site's domain.
4. Open **Messages**: a message marked “Likely spam” is never sent by email.

As long as storage is on, nothing is lost: everything stays in **Messages**. If emails still don't arrive, ask your host whether sending email through PHP is allowed. More leads are on the [Troubleshooting](https://eclair.academy/en/docs/troubleshooting) page.

## Contact form and GDPR

The form already shows its information notice and the link to your **Privacy policy**, as long as that page keeps the address `privacy-policy` or `privacy` (or a French or Spanish equivalent, such as `politique-de-confidentialite`). The page created during installation contains a “Data collected through the contact form” section: data (name, email, message), purpose, retention period, data controller and people's rights, with a reminder that visitors can contact their data protection authority (the French version names the CNIL).

Replace each placeholder in square brackets, such as “[period, e.g. 3 years]”. Good to know: with each message, Éclair also stores the sender's IP address, without displaying it in the admin. Mention it in your policy, and delete the messages you no longer need, in line with the retention period you state.

## Key points

- The **Contact form** block is added with **/**; the Contact page from the installation already has one.
- Honeypot field, token, 5 messages per network every 10 minutes and 100 per day: spam is blocked without a captcha.
- Messages arrive by email and in **Messages**, an inbox capped at 500 where spam goes first.
- No email? Check **Settings › Contact** and the official site URL, then look in **Messages**.
- Complete your privacy policy: the contact form links to it automatically.

## Going further

- [Essential settings before launch](https://eclair.academy/en/paths/beginner/essential-settings): legal notice, privacy and the launch checklist.
- [Everyday security](https://eclair.academy/en/paths/intermediate/everyday-security): the Security page, its blocks and its log.
- [Troubleshooting](https://eclair.academy/en/docs/troubleshooting): emails not received and other known issues.
- Official sources: the website of the [CNIL](https://www.cnil.fr/), France's data protection authority, and the [text of the GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) on EUR-Lex.

## Frequently asked questions

### Can I add a captcha to the form?

It's not planned, and that's deliberate: the honeypot field, token and limits block bots without bothering your visitors. Suspicious messages remain readable in **Messages**, marked “Likely spam”.

### Can I add a phone field?

No, the form has three fixed fields: name, email and message. Invite your visitors to include their number in the message if they'd like a call back.

### Are messages lost if the email doesn't arrive?

No, as long as **Also keep messages in the admin** is on, which it is by default. Each message stays in **Messages** until you delete it, up to the 500 limit.

### Why is a genuine message marked “Likely spam”?

It probably contained more than 3 links, or it was sent without the token added by the browser. It remains readable in **Messages**: reply to it as usual with the **Reply** button.