Skip to content
CRO12 min read

How to Improve Website Enquiry Forms Without Attracting Low-Quality Leads

Which enquiry form fields to keep, drop or make optional, how to stop bots without puzzles, and how to measure lead quality rather than form volume.

01

The short answer

Remove fields that do not change what you do next, explain the ones you keep, and add one or two banded qualifying questions instead of a long form. Then deal with spam, fake details and low-intent enquiries as three separate problems, because each has a different fix. Finally, judge any change by how many qualified leads it produces, not by how many forms are submitted.

Shortening a form and lengthening it are both blunt tools. A short form can flood sales with enquiries they cannot use; a long one can lose good buyers who were ready to talk. The useful question for each field is: what does this cost the visitor, and what does it tell us that we would act on?

02

Key takeaways

  • Audit fields one by one: friction cost against qualification value.
  • Use banded questions (budget, timeline) with a "not sure yet" option rather than free text or forced answers.
  • Bots, fake details and low-intent humans are different problems. Do not fight all three with one CAPTCHA.
  • Use visible labels, validate after the visitor leaves a field and describe errors in text.
  • Track generate_lead only when a submission actually arrives, then record qualify_lead and disqualify_lead so quality is measurable.
  • Tell people what you will do with their details, and keep marketing consent separate.
03

Field-by-field: what to ask, and when

This table is a starting point for a typical service business: an agency, consultancy, software studio or B2B supplier. The friction and value ratings are judgement, not measured data, so adjust them to how your sales process works. "Ask later" means collect it on the first call or in a follow-up email, once the visitor has a reason to share it.

FieldFriction costQualification valueRecommendation
NameLowLow, but needed to reply personallyAsk (one field, not first and last name separately unless your CRM needs it)
EmailLowMedium: domain hints at company vs personalAsk, with input type and autocomplete set
PhoneMedium to high: many people dislike giving itLow to medium, depending on whether you callMake optional and say why; drop it if nobody calls
CompanyLowMedium for B2B routingMake optional, or ask if you only sell to businesses
WebsiteLowHigh for agencies and auditors: lets you prepare before replyingMake optional, accept "example.com" without https://
BudgetMedium: feels intrusive if open-endedHigh: the strongest single fit signalAsk as bands with "not sure yet"; explain why you ask
TimelineLow if bandedMedium to high: separates research from buyingAsk as bands, or fold into the message prompt
Service neededLow as a dropdownHigh for routing to the right personAsk as a short list with "not sure yet"
MessageMedium: a blank box is hard to startHigh: shows intent and contextAsk, with a prompt that tells people what to include
How did you hear about us?Low to mediumLow for qualifying; useful for attributionAsk later or capture the source page automatically

Worth noting

The most-quoted form research is from checkout, not enquiries. Baymard's 2024 benchmark found the average ecommerce checkout had 11.3 form fields and that "most sites need only 8", and that field count affects usability more than the number of steps. Treat that as an analogy (fewer, better fields help) rather than a target for an enquiry form.

04

Three different problems, three different fixes

"Low-quality leads" usually mixes three things. Sort a month of enquiries into these buckets before changing anything, because the fixes pull in different directions.

1. Bots. Gibberish names, link-stuffed messages, bursts of submissions at odd hours. Fix these out of sight of real visitors. A honeypot is a hidden field that people never see but simple bots fill in; reject any submission where it has a value. Validate everything again on the server, since bots can skip your page entirely. If spam persists, add a background check. Cloudflare Turnstile has three widget modes: Managed (the visitor is asked to tick a box only if a further check is needed), Non-interactive (a spinner, never a prompt) and Invisible (no widget at all; Cloudflare says you must then reference its Turnstile privacy addendum in your privacy policy). Google reCAPTCHA v3 returns a score for each request without interrupting the visitor, where 1.0 is very likely a good interaction and 0.0 very likely a bot; Google says that "by default, you can use a threshold of 0.5" and that you should verify the action name on your server.

2. Fake details from real people. Phone numbers like 0000000000, throwaway email addresses, "asdf" in the company field. These are often a symptom of the form, not the visitor: people invent details when a field is required and they do not see why. Baymard's checkout research found 39% of benchmarked sites required a phone number "without any sort of explanation", and 14% of 1,026 surveyed shoppers said they would never give an online store their phone number. Make such fields optional, explain why you ask, and the fake answers tend to become blanks, which are more honest and easier to handle.

3. Genuine but low-intent enquiries. Students, job seekers, people wanting a free opinion, or buyers whose budget or scope will never fit. CAPTCHAs do nothing here because these are real humans. Fix them with copy and routing: say above the form who you work with and what a typical engagement involves; offer a self-serve route (a guide, a pricing explainer, a careers page) for people who are not buying; use the service and budget answers to route enquiries automatically, so a poor fit gets a polite, useful reply instead of a sales call.

05

Labels, prompts and validation

Small details decide whether a good buyer finishes the form. NN/g recommends clear, visible labels placed outside empty fields rather than placeholder text, which disappears as soon as someone types. For errors, NN/g advises waiting until the user has finished with a field and moved on before showing an error, placing the message next to the field. The exception is complex input such as a new password.

The GOV.UK Design System's question pages pattern says to "only ask users for information you really need" and to make it clear why you are asking each question. That second point is the cheapest improvement most enquiry forms can make: a short hint under the budget or phone field often does more than removing it. If your form needs several steps, see how to design multi-step forms.

  • Turn the message box into a prompt: "What are you trying to fix or build, and is there a deadline? Rough ideas are fine."
  • Write the button as the action: "Send enquiry" or "Request a call back", not "Submit".
  • Show what happens next after submission: who replies and what they will need.
  • Keep error messages specific: "Enter an email address like name@company.com", not "Invalid input".
  • Do not clear the form when the server rejects a submission.
06

Accessibility checks that also reduce drop-off

Several WCAG 2.2 criteria apply directly to enquiry forms, and meeting them tends to help everyone, not only people using assistive technology. For a broader view, see accessibility in UI/UX design.

  • WCAG 3.3.1 Error Identification (Level A): identify the field in error and describe the error in text, not only with a red border.
  • WCAG 1.3.5 Identify Input Purpose (Level AA): make the purpose of personal-data fields programmatically determinable. In practice, set autocomplete values such as name, email, tel, organization and url so browsers can fill them.
  • WCAG 3.3.7 Redundant Entry (Level A): in a multi-step form, do not ask people to retype information they already gave in the same process; carry it forward or let them select it.
  • Puzzle CAPTCHAs: 3.3.8 Accessible Authentication (Minimum) is about login and authentication steps, so it does not strictly apply to a contact form. It still points the right way: background checks are kinder than image or text puzzles.
07

Measure lead quality, not form volume

If the only number you track is submissions, any change that adds junk looks like a win. Google Analytics 4 has recommended events for the whole lead lifecycle, listed in the GA4 events reference: To connect those quality signals back to the channels that produced them, see measuring conversions across multiple channels.

EventWhat Google says it measuresWhen to send it
generate_lead"When a lead has been generated (for example, through a form)"From the browser, only after your server confirms the enquiry was received
qualify_leadWhen a user is marked as meeting the criteria to become a qualified leadFrom your CRM or a back-end process, when someone reviews the enquiry
disqualify_leadWhen a user is marked as disqualified, with a disqualified_lead_reason parameterSame, with a consistent reason list (spam, wrong service, budget, location)
close_convert_leadWhen a qualified lead is successfully converted into a customerWhen the deal is won

Pro tip

The disqualified_lead_reason values tell you which of the three problems you have. Mostly "spam" means a bot fix; mostly "budget" or "wrong service" means copy and qualifying questions. Sending lifecycle events from a CRM needs server-side work, so a simple weekly spreadsheet that tags each enquiry is a reasonable start.

08

What the form must tell people: a regional check

This is a practical summary, not legal advice. Rules differ by country and change, so check current rules with the regulator or a lawyer for each market you serve. The common thread: say who you are, why you want the details and where your privacy policy is, and ask for marketing consent separately with an unticked box.

RegionWhat to check on an enquiry form
IndiaThe Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, notified in November 2025 with obligations phased in over the following months. The Rules set out detailed requirements for consent notices. Commencement dates have been reported differently; check the current Gazette text before relying on a date.
UKUK GDPR requires clear privacy information when you collect personal data. PECR governs marketing emails, texts and calls, and was amended by the Data (Use and Access) Act 2025, which comes into force in stages. Check the ICO for which changes apply now.
UAEFederal Decree-Law No. 45 of 2021 (PDPL). Some free zones, such as DIFC and ADGM, run their own data protection regimes. Check the current status of the executive regulations and which regime covers you.
AustraliaIf the Privacy Act applies to your business, tell people how you will handle their information. Under the Spam Act, commercial emails and texts need consent, must identify the sender and must include a working unsubscribe. The ACMA expects consent to be clear; an unticked, separate opt-in is the safe design.
SingaporePDPA notification and consent apply to the enquiry. If you plan to call or text a Singapore number with marketing, the PDPC's DNC guide says you must check the Do Not Call Registry unless the person has given clear and unambiguous consent. A consent option next to the phone field is a sensible way to capture it.
09

How this site's own contact form handles it

As a factual reference, not a result: the ZSpace Labs contact form asks for name, email and project details as required fields; company, website and phone are optional, and the website field accepts an address without https://. It asks what the visitor needs and a budget range from a short list that includes "Let's discuss". A one-line privacy notice with a link to the privacy policy sits under the submit button. A hidden honeypot field is checked on the server, and the generate_lead event is sent to GA4 only after the server confirms the enquiry was delivered, never on the button click.

10

Hypothetical example: a consultancy with a busy, noisy form

Hypothetical example: a 12-person IT consultancy gets around 60 form submissions a month. A partner tags a month of them and finds roughly a third are spam, a third are job seekers or students, and a third are genuine buyers, several with fake phone numbers.

They make four changes. A honeypot and Turnstile in Managed mode for the spam. The phone field becomes optional, with "only if you'd like a call back". The careers page and a short guide are linked above the form for non-buyers. A banded "What are you looking for?" question routes partnership and job enquiries away from sales. Submissions fall, which is expected. Whether the change worked is judged by qualified enquiries per month and the reasons in disqualify_lead, compared over the next two or three months with an eye on seasonality.

11

Mistakes to avoid

  • Adding a puzzle CAPTCHA to fix low-intent enquiries. It only adds friction for buyers.
  • Making every field required "to improve quality". It mostly produces fake answers.
  • Firing generate_lead on button click, so failed submissions count as leads.
  • Asking for budget as free text, which people skip or answer with "depends".
  • Shipping form changes without testing that enquiries still reach the inbox or CRM, including spam folders.
  • Removing the message box. It is often the best signal of intent you have.
12

When this approach is not the answer

If almost all your submissions are genuine but few become customers, the form may not be the problem: the traffic, the offer or the follow-up might be. Work through why a site gets traffic but no leads first. If you get very few enquiries of any kind, adding qualifying questions will make that worse; focus on reach and the offer, and see the wider lead generation guide. For high-volume, inbound-led businesses, scoring and routing after submission may matter more than the form; automated lead qualification covers that side. If the form is fine but enquiries still do not close, work through how to improve lead quality.

13

Sources

Measurement and bot controls: Google: GA4 recommended events reference; Google: reCAPTCHA v3 (vendor documentation); Cloudflare: Turnstile widget modes (vendor documentation).

Form usability: Baymard: checkout flow average form fields (ecommerce checkout research, published 26 June 2024); Baymard: explain the phone number field (checkout research); NN/g: placeholders in form fields are harmful; NN/g: guidelines for reporting errors in forms; GOV.UK Design System: question pages.

Accessibility: W3C WCAG 2.2 Understanding documents for 3.3.1, 1.3.5, 3.3.7 and 3.3.8.

Regional: GOV.UK: DUAA factsheet, PEC Regulations; ACMA: consent expectations for businesses using direct marketing; PDPC: Do Not Call Registry for organisations; Baker McKenzie: UAE key data laws (law-firm commentary).

Accessed 14 October 2026. Vendor features, analytics events and data protection rules change; check the current versions. Nothing here is legal advice.

14

Next steps

Export the last two or three months of enquiries and tag each one as bot, fake details, low intent or genuine. Then walk the field table against your own form, fix whichever bucket is largest first, and set up generate_lead and qualify_lead so the next change can be judged on quality. If you want an outside view, a CRO audit can cover the form, the page around it and the tracking together.

Want a second pair of eyes on your enquiry form?

ZSpace Labs is a remote-first technology studio that works with clients globally on CRO audits and form and page redesign. If useful, we can talk through your form, your spam and lead-quality picture, and what to change first.

Start a Project
FAQ

Common questions.

There is no reliable number for enquiry forms. Start from the fields your team actually uses to reply and route the enquiry, which for most service businesses is name, email, a short description of the need and one or two banded qualifying questions. Every other field should earn its place by changing what you do next.

Get in touch

Have a project in mind?

Whether you're building a new digital product, improving an existing website, or looking to automate part of your business — let's talk.