LFW

Blog · Getting forms right

User Experience on Web Forms

Labels, placeholders, no-reload submissions, confirmation messages, and the delivery problems that start after someone clicks submit.

Placeholders are not labels

Placeholder text disappears as soon as someone starts typing. That makes it a poor place for anything they may need later, especially on long forms, on phones, or on forms that show validation errors.

Labels should usually stay visible. Placeholders can still help as an example or a format hint, but they shouldn't be the only explanation of what a field is for.

Submitting without a page reload

AJAX submissions, which send the form without reloading the page, can make it feel faster and calmer, but only when every change of state is obvious. The button should show progress. Duplicate submissions should be blocked. Errors should appear next to the field that needs fixing, and success should look final.

If your form quietly clears itself after submit, people are left wondering whether it worked. They need confirmation that their message went somewhere.

The form experience continues after submit

The job isn't done when the browser says the form was submitted. Someone still has to receive the email, the CRM record, the notification, or the internal task.

This is where form design becomes an operations question. Confirmation messages, routing, tracking, spam protection, and email deliverability all decide whether the form actually works.

Keep reading

September 20, 2026 4 minutes

What a Stranger Learns About Your Site in One Minute

Everything in this article is public. It is what a curious visitor, a vendor sizing you up, a journalist, or a scanner run by someone less friendly can read about your website in about a minute. The free audit runs those same checks for you, and you can try it at the end of this article. Here is what it looks at, in the order a stranger would.

September 20, 2026 3 minutes

Login Names Are Half a Login

By default, a WordPress site will list its users for anyone who asks. You get every author's login name, in a machine-readable list, at a fixed address. Attackers don't have to guess who the accounts are. They only have to guess the passwords. This post covers where the list comes from, how the free audit reports it, and four changes that close it without locking anyone out.

All articles

    Powered by LFW Search
    Prefer to write?

    Tell us what needs to work better.

    Slow, fragile, hard to edit, missing a workflow. Say it plainly, and you'll get a straight answer, not a ticket number.