Protect email addresses in your directory with a contact form

The Constituent element's Directory and Profile formats support a Contact Form option that replaces visible email addresses with a "Contact" link, routing messages securely to the staff member's primary email in Constituent Manager without exposing the address. This protects against phishing and spam while keeping communication easy. Each message also arrives marked as unverified, so staff can recognize and safely handle suspicious requests. 

This feature is sometimes referred to as a "Send Email button", "contact link", or "hidden email link" in staff directories. Instead of a clickable email address, visitors see a "Contact" link, button, or email icon that opens a secure form. However, this is not created by manually adding a button but is a separate, customized process in the Constituent element settings. Read on to learn more!

💡Quick answers

  • Where is the Contact Form option in the Constituent element settings? In the Email(s) field within Constituent Details, Pop-Up Details, or Field Details (depending on format); select "Contact Form" instead of text or icon display.
  • What happens when a site visitor clicks the Contact link? A contact form opens; the submission is delivered to the staff member's primary email address in Constituent Manager. The visitor sees an on-screen confirmation after submitting.
  • Can administrators see a log of all messages sent through contact forms? No; messages go directly to the recipient's inbox and are not stored centrally.
  • Which Constituent element formats support the Contact Form option? Directory and Profile formats only; the Search format does not support it.
  • Can the "Contact" link text be customized? Not currently; customization is logged as a future enhancement.
  • How are messages sent through a Contact form marked as unverified? Because anyone can submit the public Contact form, Finalsite cannot confirm the sender's identity. Each message arrives with a [Website contact] subject prefix and a banner at the top of the email noting that the sender is not verified.

Display a staff contact form in your directory in addition to a standard envelope icon or contact link so that families can contact individual staff members directly through a secure window, rather than exposing a raw email address. By choosing to submit contact through a form, you protect your staff directory email staff workflows from phishing and spam, while helping community members reach the right person quickly.

Interested in other options? Check out the article, "Hide directory emails from spammers: Strategies and options."

Important Note

The ability to display a Contact link and secure message window is unique to the Constituent element’s Directory and Profile formats. It’s separate from the Forms feature in Composer.

In this article


Understanding the user journey

Users (family and community members) navigate to faculty and staff profiles that may live either in a directory or on department pages. Now, instead of seeing an email address as a text link or email  icon, users will see a Contact Form associated with each faculty or staff member.

  • User initiates contact: User wishes to send communication to a specific faculty or staff member.
  • User accesses secure form: User clicks the word Contact and a Contact Form opens in the same window.
  • Contact is delivered to recipient email: When submitted, the information in the Contact form is delivered to the Primary email address that is connected to the constituent’s account in their Constituent profile in Constituent Manager. A message will appear on the screen letting them know that their message was sent successfully. 


  • User sees a confirmation: The user gets a confirmation message on the pop-up immediately after submission.
  • Staff member receives the message: The email arrives with a [Website contact] subject prefix and a banner noting that the sender's identity is not verified.

Ready to get started? 

Step 1: Create a directory page

Before you configure your Constituent element settings to display Contact forms instead of email addresses, it’s important to understand all of the options you might want to consider for your directory page.

Check out the article, “Create a directory page” to see the bigger picture. 

Step 2: Configure each Constituent element to display a Contact link

Because a directory page might include various Constituent elements selected to display in different formats, you want to be sure to configure each individual Constituent element on your directory page. Once you add a new Constituent element, you can configure its settings to change both the format and how it behaves on your directory page.

A Constituent element can be displayed in the following formats:

  • Directory
  • Profile
  • Search 

Important Note

The ability to communicate with a constituent via Contact Form is possible only in the Directory and Profile formats. Learn more about all of the settings that are possible in the article, “Constituent element.” 

In each of these instances, select the Contact Form option next to Email(s). 

The setting that is specific to hiding email addresses and providing a contact form to your site visitors can be found in the following Constituent element settings: 

  • Directory format > Constituent Details > Email(s)
  • Directory format > Pop-Up Details > Constituent role format > Email(s)
  • Directory format > Pop-Up Details > Custom format > Email(s) 
  • Profile format > Field Details > Constituent role format > Email(s)
  • Profile format > Field Details > Custom format > Email(s) 

Step 3: Confirm Contact link display

Once you have adjusted this setting, the Constituent element should display the word Contact where previously might have been an envelope icon or the email address for a constituent.

  • The Contact link will now display under the main Constituent Details and within the Popup Details areas.

The ability to customize the Contact link text displaying in the element is not available at the moment, but has been logged for future enhancement.

Step 4: Configure other areas

Repeat configurations in any other areas (listed in Step 2) so that you have thoroughly hidden all instances of Email addresses displaying on pages. 

Additional configurations needed? 

  • Do you have any directory page(s) on school sites? 
  • Are any Constituent profiles displayed on department or administrative team pages? 

Don’t forget to configure each Constituent element’s settings to provide a Contact link in all places.

Step 5: Publish your page

Once you have made your configurations, Publish your page and try it out!

Step 6: Manage reporting and confirmations

Administrators often ask how to verify if a message was successfully sent if a community member claims they haven't received a response.

How can I tell that a message was sent?

Each message sent through the Contact form can be confirmed in three places:

  1. On-screen confirmation: Immediately upon clicking Submit, the user sees a confirmation message on the directory page confirming the message was sent successfully.

  2. Staff member's inbox: The message arrives in the staff member's primary email with a [Website contact] subject prefix and an unverified-sender banner, so staff can check their inbox if a visitor says a message was sent. 

  3. Message details: The email the staff member receives lists the sender's name and email address, the subject, the message, and the date and time it was submitted, so staff can match it to a visitor's report.

What does the user confirmation look like?

When a user submits the form, they receive an on-screen message telling them the message was sent successfully. They do not receive an email copy of their message.

How are Contact form emails marked as unverified?

Because the Contact form is available to anyone who visits your public website, Finalsite cannot confirm who is sending a message. To help staff recognize this, every message delivered through a Contact form includes two safeguards:

  • A subject line prefix: The email subject begins with [Website contact], so staff members can quickly recognize a message that came from the public website and can use it to build mail filters or rules.
  • An unverified sender banner: The top of the email body displays the following notice: "Sent through the public website contact form. The sender's identity is not verified. Do not act on requests for gift cards, payments, payroll changes or texting a phone number without confirming through a known channel."
new email verification reply 2026.png

⚠️ Important Notes

  • The banner and subject prefix are added automatically. They cannot be edited or turned off, and they also appear when your school uses a custom email sending domain.
  • Encourage staff to verify unexpected or urgent requests, especially those asking for money, gift cards, payroll changes, or a text message to an unfamiliar number, by contacting the sender through a known channel, such as a phone number or email address they already have on file.

What if a community member says they did not hear back?

  • Ask for the date and time they submitted the form and which staff member they contacted. 
  • Then ask that staff member to check their inbox and spam folder for a message with the [Website contact] subject prefix. 
  • The date and time in the email can be matched to the visitor's submission.

FAQs

Q: Can a site administrator view a history of all messages sent through these forms? 
A: No. To maintain privacy and security, these messages are delivered directly to the recipient's primary email address. Finalsite does not store a searchable database of these individual communications.

Q: Does the faculty member see who sent the message? 
A: Yes. The email delivered to the faculty member includes the name and email address provided by the user in the form fields, allowing the staff member to reply directly from their own inbox.

Q: Can the faculty member reply to continue communication with the sender? 
A: Yes, there is a statement in the email the faculty member receives that states: "You can reply directly to this email and your response will be sent to the sender's email."

Q: Why do contact form emails start with "[Website contact]" and a warning banner?
A: The Contact form is public, so the sender's identity is not verified. The subject prefix and banner remind staff to treat the message with care and to confirm unexpected requests, such as gift cards, payments, payroll changes, or texting a phone number, through a known channel before acting. See "How are Contact form emails marked as unverified?" above.

Q: Can we remove the banner or change the subject prefix?
A: No. The banner and prefix are applied automatically to all messages sent through a Contact form.