A form is a conversation between the interface and the user. Accessible form design makes the requested information clear, allows different input methods, preserves work when something fails, and places correction guidance where it is needed. Validation should prevent avoidable mistakes without turning the form into an obstacle.
Use persistent, programmatic labels
Every control needs a visible label connected with for and id, or an equivalent accessible name. Placeholder text is a hint, not a label; it disappears and often has weak contrast. Add brief help text for format or purpose and connect it with aria-describedby when that information is important.
Choose controls that match the data
Use email, url, date, number, select, radio, and checkbox controls where their built-in behavior helps. Do not use a clickable div as a button. Set autocomplete values for common personal fields, use sensible input modes on mobile, and avoid blocking paste in password or confirmation fields.
Validate at the right time
Validate on submission and, where useful, after a field has been visited. Showing errors while someone is still typing can be distracting. Keep valid input, focus the first invalid control, summarize problems for long forms, and place a specific message beside each field. ‘Enter an email such as name@example.com’ is more useful than ‘Invalid input.’
Repeat validation on the server
Browser validation can be bypassed. The backend must verify required fields, lengths, formats, allowed values, permissions, and rate limits. Escape rendered values and protect state-changing requests. Return errors in a consistent structure so the same interface can display them clearly.
Test the complete interaction
Complete the form using only a keyboard, then zoom text and test at a narrow width. Submit it empty, with one incorrect field, and with valid data followed by a server failure. Confirm that focus, messages, preserved values, and success feedback all make sense without relying only on color.
Form release checklist
Confirm labels, help text, required indicators, autocomplete, error association, focus order, keyboard submission, preserved values, server validation, rate limiting, and success confirmation. Test the form with unusually long but valid names and messages. Review the email or stored result for header injection, unexpected markup, and encoding problems. A form is complete only when both successful and failed submissions are understandable.