A visible form is only the first part of a contact system. The useful outcome is a valid inquiry arriving in a monitored inbox, with a clear result shown to the person who sent it.
Validate the submission
The browser can catch empty fields and obvious formatting errors. The server endpoint must validate again because requests can bypass the browser. It should accept only the expected method, content type, fields, and reasonable lengths.
Verify anti-spam tokens on the server
Cloudflare Turnstile produces a token in the browser, but the Worker must send that token to Siteverify before trusting it. Cloudflare documents that tokens are single-use and expire after five minutes. The response can also be checked for the expected hostname and action.
Deliver to a real destination
The endpoint builds a plain, readable message and sends it only to an approved address. The destination, sender, and any email-service credentials belong in provider configuration, never in public source files.
Business email is a related but separate setup. A domain mailbox or forwarding route needs the correct provider records and a real delivery test. The website should not claim that email works because a DNS screen looks complete.
Plan the failure path
If token validation or delivery fails, the form should say so and offer a direct email address. Logs should record enough to diagnose the failure without unnecessarily storing the full message or other personal information.
Cloudflare’s Turnstile validation guide explains why browser-only verification is incomplete.