My team builds a form backend, and the most common message we get is some version of "my form stopped working". Usually the form never worked. Someone generated the site, clicked Send once, saw a green "Message sent!" and moved on. In early October we got tired of guessing how often that happens and decided to count it on sites built with Lovable and Bolt.

On paper the plan was short. Open a live site, find the contact form, fill it in with test values nobody would type for real, press Send and watch what leaves the page. If a request goes out with our text in it, the form sends. If nothing goes out and the page still celebrates, the form is fake. Every request after the click was blocked in the browser, so no site owner got a test message from us.

We wrote the rules down before the first site was tested. The test went through 793 sites and found 119 contact forms.…