fablgen Fixed £35 repair
False-success test · five manual checks

Contact form says “sent” but no email arrives?

A success message proves only that the page changed. Static Form Inspector now warns when inline JavaScript cancels native submission, shows success, and contains no visible delivery call. That is the fastest check; the five steps below verify the rest of the path.

Test the form source privately Read the five checks

The browser inspector processes pasted HTML on your device and makes no inspector network request. It does not follow external scripts or unfamiliar helper functions. Never paste secrets, private customer messages, or production submission data.

BrowserDid the page actually create a request?
EndpointDid the configured service accept it?
InboxDid the owner confirm receipt?
Reproducible diagnosis

Five checks, in order

1

Check whether the form submits anywhere

Inspect the opening <form> tag and its submit handler. An empty action, action="#", or JavaScript that cancels submission and only changes visible state can produce a convincing “sent” message without delivering anything.

form.addEventListener('submit', (event) => {
  event.preventDefault();
  status.textContent = 'Message sent!';
  form.reset();
});

The free inspector reports this conservative pattern as cancelled-submit-without-delivery. It suppresses the warning when the same inline source contains a visible Fetch, Axios, XMLHttpRequest, Beacon, jQuery Ajax, EmailJS, submit(), or requestSubmit() delivery path. It does not claim to analyse code in external script files.

A mailto: action is different but still fragile: it asks the visitor’s device to open an email application. It is not an in-browser delivery endpoint.

Pass conditionThe form points to an owner-approved HTTPS endpoint or application route, and the submit handler sends a real request before showing success.
2

Check every value has a field name

Browsers submit successful controls by name. A visitor can type into an email input or message box that looks correct, but a missing name means that value is normally omitted from a standard form submission.

<input type="email" name="email" required>
<textarea name="message" required></textarea>
Pass conditionEvery enabled value the owner expects to receive has the exact field name required by the receiving endpoint.
3

Remove placeholders without exposing secrets

Copied examples often retain values such as YOUR_ACCESS_KEY, example@example.com, or an endpoint ending in /example. Those values may allow the interface to render while preventing real routing.

Do not fix this by committing an inbox password or private API secret to frontend code. Use the form provider’s documented public form identifier, an owner-controlled backend route, or deployment-time server configuration as appropriate.

Pass conditionNo placeholder remains, and any sensitive credential stays outside public HTML and client-side JavaScript.
4

Separate endpoint acceptance from inbox receipt

An HTTP success response means the endpoint accepted or processed a request according to its own contract. It does not, by itself, prove that an email reached the owner’s inbox. Delivery can still depend on account activation, recipient confirmation, provider rules, spam filtering, or downstream mail handling.

Use synthetic data such as “Website delivery test — 2026-08-15” and ask the endpoint owner to confirm the exact message arrived. Do not use a real customer’s details for testing.

Pass conditionThe browser receives the expected endpoint response and the authorised owner independently confirms the matching synthetic message.
5

Test failure as carefully as success

A reliable form disables duplicate submits while sending, announces its status, and shows an honest retry path when the network or endpoint fails. It must not display success unconditionally after a timer or local state change.

Test required-field validation, an endpoint rejection in a non-production environment, keyboard submission, and a common phone width. Keep visible phone or email details as a fallback when the business supports them.

Pass conditionSuccess appears only after the expected response; failures remain failures, preserve useful input where safe, and tell the visitor what to do next.
Short answers

Contact-form delivery FAQ

Can a form say “sent” without making a request?

Yes. A handler can call preventDefault(), change the message on the page, and reset the form without sending anything. Confirm the handler contains a real delivery path and use the browser Network panel during a synthetic submission.

Can a source-code check prove that email arrives?

No. It can find suspicious or missing configuration. Only a synthetic end-to-end test plus owner-confirmed receipt proves the full path.

Does a mailto form count as a working form?

It can be a visible fallback, but it depends on the visitor having a configured email application and is not an in-browser submission flow.

Should I share an endpoint key or inbox password?

No. Keep production secrets, inbox access, private messages, and customer data private. A diagnosis should begin with public source and synthetic test data.

Want the source checked first?

Static Form Inspector can identify false-success handlers, inert actions, placeholder endpoint tokens, contact-like GET forms, unnamed controls, and unclosed forms without submitting data. The same rules can run in CI with the dependency-free GitHub Action. If implementation is needed, the fixed £35 repair covers one public form with written acceptance checks and payment after review.

Inspect HTML in the browser Add the GitHub Action See the £35 repair scope