LFW

Blog · Getting forms right

Catching Email Typos Without Blocking Anyone

gamil.com is a valid email format, and a lead you will never reach. How to catch the common typos: when to check, how to ask, and why the visitor always gets the final say.

gamil.com is not a typo to your form

Someone finds your organization, fills in your form, and types their email one letter off: gamil.com instead of gmail.com. Every validator accepts it, and it should, because it's a correctly formed address. It just isn't theirs.

Then your reply, report, or registration confirmation bounces somewhere you'll never look, and the visitor waits. From their side, they wrote to you and you never answered. The typo was theirs, but the silence looks like yours.

Where it actually costs you

The people typing their email into your site are the ones you worked hardest to reach: the member renewing, the donor deciding, the event guest, the prospect requesting your report. If you lose one to a transposed letter, everything expensive already worked and the cheapest step failed.

It happens often. A few percent of hand-typed addresses contain a typo, and the most common ones are predictable: gamil, gmial, hotmial, yaho, and .cm or .con where a finger missed the o.

When to check, and when to leave people alone

Checking on every keystroke wears people out. Half-typed addresses all look wrong, so the form spends ten seconds flagging an 'error' the visitor was two characters from fixing.

Check twice: when the visitor leaves the field after typing, and again when they press submit. Those are the two moments the address should be finished, so they are the only moments worth raising a question.

Ask, explain, and let them win

When the check fires, it should read like a helpful note: “gamil.com is usually a typo of gmail.com. One tap fixes it, or keep what you typed if that's really your address.” The explanation matters. 'Invalid email' tells the visitor nothing and is wrong for everyone who typed correctly. Naming the likely typo lets them decide in a second.

It must always be a question the visitor can answer, because unusual addresses are real. Somebody really does have that domain. A safe check flags only a short list of well-known typos and obvious .com slips, never questions an organization's own domain (yourorg.cm might really be in Cameroon), and remembers the answer so it asks only once.

Every public form on this site works this way: the contact form, the booking flow, event RSVPs, and the free audit. Type gamil.com into any of them and it will ask you, once.

The rule behind it

The same rule applies beyond email: validation should protect what the visitor meant to do. A form that blocks real people to catch hypothetical mistakes is working against them. Catch the mistakes you can name, ask instead of assuming, and make it easy for someone who typed correctly to carry on.

That's what this series covers: the small decisions that decide whether people finish your form or abandon it.

Keep reading

September 20, 2026 4 minutes

What a Stranger Learns About Your Site in One Minute

Everything in this article is public. It is what a curious visitor, a vendor sizing you up, a journalist, or a scanner run by someone less friendly can read about your website in about a minute. The free audit runs those same checks for you, and you can try it at the end of this article. Here is what it looks at, in the order a stranger would.

September 20, 2026 3 minutes

Login Names Are Half a Login

By default, a WordPress site will list its users for anyone who asks. You get every author's login name, in a machine-readable list, at a fixed address. Attackers don't have to guess who the accounts are. They only have to guess the passwords. This post covers where the list comes from, how the free audit reports it, and four changes that close it without locking anyone out.

All articles

    Powered by LFW Search
    Prefer to write?

    Tell us what needs to work better.

    Slow, fragile, hard to edit, missing a workflow. Say it plainly, and you'll get a straight answer, not a ticket number.