No leads from the website? Two opposite causes, and one popular fix that makes it worse.

The sentence is always the same. The website does not generate any leads.

Before anyone quotes you for a rebuild, it is worth ruling out the two boring explanations, because they are opposites and the usual remedy for one quietly worsens the other.

Cause one: the message never reached you

Contact forms fail silently by design. The visitor sees a thank-you screen, so nobody complains, and nobody complains for months.

The classic version is an address nobody reads: the form still points at a staff member who left in 2023, or at info@ that forwards somewhere abandoned. Worth checking before anything technical.

The subtler version is an authentication problem, and it is extremely common because it looks like a helpful feature. Plenty of forms put the visitor's email address in the From header, so the notification appears to come from the person enquiring and you can hit reply straight away. Whoever set it up did it deliberately, and for a while it works fine. It is convenient, and it is also your website claiming to be a message from someone else's mailbox, which is a thing mail providers have spent a decade getting stricter about. The behaviour that made it useful is the behaviour that makes it suspicious.

Google asks every sender, regardless of volume, not to impersonate Gmail From: headers and to authenticate properly. A form sending as customer@gmail.com through your host is doing exactly the thing the rule names, which is a decent way to have your own lead notifications filed as junk.

The fix is small: send the notification From your own authenticated domain, put the visitor in Reply-To, and keep the convenience without the impersonation. The wider set of sender rules is worth reading if your marketing email is also underperforming, since it is the same machinery.

Cause two: the real ones are buried

The other version is that everything arrives and there is too much of it. Enough automated junk comes through that the inbox stops being checked properly, and a genuine enquiry sits unread between two pieces of nonsense about SEO services.

This one is worse than it looks, because the damage is to a habit rather than to a system. Once somebody has learned that the form folder is mostly rubbish, they stop reading it carefully, and the lead that arrives on a busy Thursday is the one that gets skimmed past.

The reCAPTCHA thing almost everybody gets wrong

Here is where the popular fix stops working. There are two versions in common use and they behave completely differently.

Version 2 is the one people picture: a checkbox, sometimes a grid of traffic lights. It asks the user to prove something, which means it does block submissions and it does add friction to every genuine customer as well.

Version 3 is invisible. Google describes it as verifying whether an interaction is legitimate without any user interaction, and says it will never interrupt your users. It is a JavaScript API that returns a score between 0.0 and 1.0, where 1.0 is very likely a good interaction and 0.0 is very likely a bot.

Read that carefully. It returns a number.

It does not stop anything.

Google is explicit that you take variable action in the context of your site, and even suggests running it without taking action at first and setting thresholds after looking at your own traffic, with 0.5 offered as a starting point. All of which assumes somebody wrote the logic that reads the score and decides what to do. Install the script, skip that part, and you have a badge in the corner of your form, a slightly slower page, and precisely the same amount of spam as before.

That configuration is everywhere, and it feels like protection, which is the problem.

What to do about it

Decide which failure you actually have before touching anything, because the fixes point in opposite directions. If submissions are not arriving, adding friction achieves nothing. If you are drowning, adding a checkbox will help and will cost you some genuine enquiries from people on phones in a hurry.

If v3 is already installed, the job is to use the score rather than to install something else. Pick a threshold and write the logic that acts on it, then send the borderline submissions somewhere a human reviews instead of deleting them outright, because a threshold set too aggressively silently discards customers and you will never see the ones you lost. Quiet server-side measures belong first in the order regardless, since anything that never shows itself to a customer costs you nothing in conversion.

Test it like a stranger, on a schedule

Once a month, fill in your own form from your phone, on mobile data, using an address that is not connected to the business. Then find out where it landed and how long it took to get there. The folder it arrives in tells you as much as whether it arrived at all.

That single habit catches most of this before it becomes a quarter of missing enquiries. It is the same discipline as checking where your Book button actually goes: the parts of your marketing that fail quietly are the ones nobody is assigned to watch.

If you would rather have someone confirm your forms actually deliver and are authenticated properly, book a strategy call. It is usually an hour of work, and it is a strange thing to discover after a year of assuming the market simply was not interested.