Validate contact form submissions and return JSON responses via webhook

Quick overview

This workflow receives contact form submissions via an n8n Webhook, validates name/email/message fields, and returns a JSON response with either a success message or a list of validation errors, while silently accepting likely bot submissions flagged by a honeypot field.

How it works

1. Receives a POST request from a contact form via an n8n Webhook endpoint.
2. Loads validation limits (maximum name length, maximum message length, and the honeypot field name) and normalizes the incoming fields.
3. Validates required fields and formats, classifying the submission as valid, invalid, or spam based on errors and whether the honeypot field is filled.
4. For valid submissions, runs your chosen follow-up action (for example storing the message or notifying a team) and then returns a 200 JSON success response.
5. For invalid submissions, returns a 400 JSON response containing one readable error message per validation issue.
6. For spam submissions, returns a 200 JSON success response but skips any follow-up processing.

Setup

1. Activate the workflow and copy the Webhook Production URL to configure it as the form’s POST target.
2. Ensure your form sends fields name, email, and message, plus an empty hidden honeypot field named website (or update the workflow to match your field name).
3. Adjust the maximum lengths and honeypot field name in the Settings step to match your form requirements.
4. Replace the placeholder follow-up step with your desired action for valid submissions (for example Send Email, Google Sheets, Slack, or a CRM), adding the required credentials for that service if needed.

Requirements

• Tested on n8n 1.123.92 (self-hosted). No credentials are needed for the validation part; only the node you put in place of "Your action here" may need one.

Customization

• Change the webhook Path, the length limits and the honeypot field name in Settings. For heavy spam, add a CAPTCHA check (an HTTP Request to your CAPTCHA provider's verify endpoint) before Route by status. If your form is on another domain, set the Allowed Origins (CORS) option of the Webhook node.

Additional info

Tested requests: valid JSON (extra spaces, upper-case email) → 200, email stored lower-case; valid application/x-www-form-urlencoded form → 200; empty JSON {} → 400 with name/email/message required; email jane@example plus a 2001-character message → 400 with both errors; honeypot filled → 200, only "Respond 200 to bot" runs; GET instead of POST → 404 from n8n.

Limitations: the email check is a format check only and does not prove the address exists. The browser waits until "Respond 200 OK" runs, so a slow action delays the answer; move the response node in front of the action if that matters. The Test URL only works while the editor is listening; point your form at the Production URL.

Step-by-step guide to the Webhook node (Test vs Production URL, response modes, authentication, common 404 errors): https://codingkit.com/n8n/webhook/