Content and lead-generation websites in Sharjah: forms, spam and speed

A content and lead-generation website for a Sharjah business has two jobs: publish articles, portfolios and service pages people want to read, and turn readers into enquiries that actually land in your inbox. Get both right by sending form email through authenticated SMTP, blocking spam with a free challenge such as Cloudflare Turnstile, structuring Arabic and English content cleanly, giving your team the right WordPress roles, keeping images light, setting a performance budget, and only running analytics with consent.

A made-up story with a painful ending. A small video production company licensed in Sharjah publishes two showreel posts a week. Traffic grows nicely. Then a client mentions she filled in the contact form three times last month and never heard back. The form had been "sending" every enquiry through the server's default mail function, and Gmail had been quietly filing them as spam. Weeks of leads, gone.

By the end of this guide you will have forms that reach your inbox with a saved copy of every enquiry, spam protection that does not annoy real people, a clear bilingual content structure, an editorial workflow with safe permissions, faster images, and analytics that respect consent.

What a content and lead-generation site needs

Think of your site as a magazine with a reply card inside. The magazine is your content: articles, case studies, service pages and portfolio pieces. The reply card is your contact form, WhatsApp button or newsletter sign-up. A beautiful magazine with reply cards that never reach the post office is a very expensive hobby.

This matters for many Sharjah businesses. Shams, the Sharjah Media City free zone, describes itself as a free zone dedicated to media and creativity, established in 2017 by decree of the Ruler of Sharjah. Whether you are licensed there, in another free zone or on the mainland, if your website is your portfolio and lead source, the setup below is your foundation.

Before you start

• WordPress administrator access and your hosting control panel login.
• A mailbox on your own domain that will send the website's emails, such as website@example.com.
• A contact form plugin. The examples use Contact Form 7, which its WordPress.org page lists with more than 10 million active installations at the time of writing (3 October 2026). Other form plugins have similar settings.
• A free Cloudflare account for Turnstile. You do not need to move your DNS to Cloudflare to use it.
• A recent backup of the site.
• About two hours.

Part 1: Forms that actually reach your inbox

By default, WordPress sends email through the server's PHP mail function. Those messages often lack the authentication that Gmail and Outlook look for, so they land in spam or vanish. The fix is to send through a real, authenticated mailbox using SMTP, the standard protocol for sending email.

Step 1: Create a sending mailbox

In cPanel, go to Email > Email Accounts and create a mailbox such as website@example.com with a strong password. Click Connect Devices next to it; cPanel opens its Set Up Mail Client interface, which shows the mail server settings for that account. Note the outgoing (SMTP) server name and port.

If your email runs on Google Workspace or Microsoft 365 instead, use a mailbox there and check your provider's SMTP instructions. Many providers require an app password rather than your normal password.

Step 2: Install and configure WP Mail SMTP

WP Mail SMTP is a free plugin that routes all WordPress email through the mailbox you choose. Its WordPress.org page lists more than 4 million active installations. Install it from Plugins > Add New Plugin, activate it, then go to WP Mail SMTP > Settings and fill in the General tab:

• From Email: the mailbox you just created, for example website@example.com.
• Force From Email: tick it, so every plugin uses the same sender.
• From Name: your business name.
• Mailer: choose Other SMTP.
• SMTP Host: the outgoing server from Step 1.
• Encryption and SMTP Port: TLS with port 587, or SSL with port 465, matching your provider's settings.
• Authentication: on.
• SMTP Username and SMTP Password: the full mailbox address and its password (or app password).

Save the settings. Quick tip: WP Mail SMTP's documentation recommends storing the username and password as constants in wp-config.php rather than in the database, and links to instructions for doing so.

Step 3: Send a test email

Go to WP Mail SMTP > Tools, open the Email Test tab, enter a Gmail or Outlook address you can check, and click Send Email. The test message should arrive in the inbox, not spam. If it fails, the plugin shows an error; the troubleshooting section below covers the usual causes.

Step 4: Set the form's From and Reply-To correctly

In Contact Form 7, open your form under Contact > Contact Forms and go to the Mail tab:

• To: the inbox where your team reads enquiries, such as sales@example.com.
• From: Contact Form 7's documentation says this should be an address on the same domain as the website. Use the sending mailbox, for example Example Studio <website@example.com>.
• Additional Headers: add Reply-To: [your-email] on its own line, so pressing Reply answers the visitor rather than your own sending address.

Putting the visitor's address in the From field makes your server pretend to be Gmail or Yahoo, which is exactly what spam filters are built to catch.

Step 5: Keep a copy of every enquiry

Even good email setups fail sometimes. Flamingo, a free plugin by the author of Contact Form 7, saves every form submission in the WordPress database. After you install and activate it, submissions appear under Inbound Messages in the dashboard. It works automatically with Contact Form 7's standard field names, such as your-name and your-email.

Heads up: a saved enquiry is personal data. Decide how long you keep them, delete old ones on schedule, and mention it in your privacy notice.

Step 6: Authenticate your domain

SMTP gets your messages sent from a real mailbox. SPF, DKIM and DMARC records prove that mailbox is allowed to send for your domain. Our SPF, DKIM and DMARC guide has the exact records for hosting email, Google Workspace and Microsoft 365.

Part 2: Stop form spam without annoying people

Once your form works, bots will find it. Cloudflare Turnstile is a free alternative to the "click all the traffic lights" puzzle: in its recommended Managed mode, it only shows an interaction when traffic looks automated. Cloudflare's documentation says Turnstile can be used without any other Cloudflare services, and free accounts can create up to 20 widgets.

Step 1: Create a Turnstile widget

1. In the Cloudflare dashboard, open the Turnstile page.
2. Select Add widget.
3. Enter a Widget name, add your domain under Hostname management, and choose Managed as the Widget mode.
4. Select Create, then copy the site key and secret key. Keep the secret key private.

Step 2: Connect it to Contact Form 7

Contact Form 7 has a built-in Turnstile integration. Go to Contact > Integration, find the Turnstile section, click Setup integration, paste both keys and save. According to Contact Form 7's documentation, all your contact forms then show the Turnstile widget automatically. To move the widget from its default position at the top of the form, add the [turnstile] form-tag where you want it.

Contact Form 7 also integrates with Google reCAPTCHA and Akismet. If you use a different form plugin, look for a Turnstile or reCAPTCHA option in its settings or documentation.

Part 3: Structure your Arabic and English content

Many Sharjah audiences read in both Arabic and English. A clear structure helps readers and search engines alike:

• One page per language, linked as translations, never both languages crammed onto one page.
• The same structure in both languages: matching categories, menus and service pages, so readers can switch at any point.
• Translated addresses: /en/services/ and /ar/services/ read better than mixed-language slugs.
• Human review: machine translation is a useful first draft, but have a fluent speaker review anything a client will read.
• A visible language switcher in the header, on every page.

The setup itself, with Polylang, an RTL-ready theme and language-based URLs, is walked through step by step in our Dubai launch guide.

Part 4: Set up an editorial workflow with roles

A content site usually has several people touching it: writers, an editor, perhaps a designer and an agency. Give each the smallest role that lets them do their job. WordPress's documentation summarises the built-in roles:

• Contributor: can write and manage their own posts but cannot publish them.
• Author: can publish and manage their own posts.
• Editor: can publish and manage posts, including other users' posts.
• Administrator: has access to all administration features.

A simple workflow that works for small teams:

1. Writers are Contributors. When a draft is ready, they click Submit for Review, which marks it as pending.
2. The Editor checks the pending post: headline, excerpt, facts, links, featured image and its alt text, and both language versions.
3. The Editor publishes it or schedules it for a set time.
4. Only the business owner, and perhaps one trusted technical person, holds Administrator accounts.

Two settings help the workflow. Set Settings > General > Timezone to Dubai so scheduled posts go out at UAE times. And remember that WordPress keeps revisions of each post, so an editor can compare and restore an earlier version from the editor's revisions screen if something goes wrong.

For login security, user clean-ups and two-factor authentication, see our Abu Dhabi security guide.

Part 5: Keep images light

Photos and showreel thumbnails are usually the heaviest part of a content site. Three habits keep them under control:

• Resize before you upload. A photo straight from a modern phone is far larger than any web page needs. Export images at roughly the largest size your theme displays them.
• Use modern formats. The free Modern Image Formats plugin, made by the WordPress Performance Team, converts uploaded JPEG and PNG images to AVIF when the server supports it, and to WebP otherwise. Its options are under Settings > Media. At the time of writing it lists more than 100,000 active installations.
• Write alt text. A short description of each image helps screen-reader users and tells search engines what the image shows. In Arabic posts, write the alt text in Arabic.

Part 6: Set a performance budget

A performance budget is a limit you agree on before anyone adds a new slider, font or tracking script. Base it on Google's Core Web Vitals. According to web.dev, a good experience means:

• Largest Contentful Paint (LCP): within 2.5 seconds, measuring loading.
• Interaction to Next Paint (INP): 200 milliseconds or less, measuring responsiveness.
• Cumulative Layout Shift (CLS): 0.1 or less, measuring visual stability.

web.dev recommends measuring at the 75th percentile of page loads, separately for mobile and desktop. A practical budget for a small team might be: every key page meets those three targets on mobile in PageSpeed Insights, no single image over a few hundred kilobytes, and no new third-party script without a reason written down.

Check the homepage, one article and one Arabic page each month. If a page slips, find what changed. Page caching helps a lot here; on LiteSpeed servers, our LiteSpeed Cache guide covers the settings.

Part 7: Analytics with consent

You need numbers to know which articles bring enquiries. You also need to respect your readers' choices and the law.

• Decide what you actually need: page views, top articles, form submissions and traffic sources usually cover it.
• Ask before setting non-essential cookies. If your analytics tool sets cookies, use a consent banner that blocks the tracking script until the visitor accepts, and lets them say no as easily as yes.
• Count form submissions without extra tracking where you can, for example by sending visitors to a thank-you page after a successful submission and counting visits to it.
• Say what you collect in your privacy notice, and link it from the banner.

The UAE's PDPL generally requires consent for processing personal data, with specific exceptions; our UAE hosting pillar guide summarises the basics. This is general information, not legal advice.

How to check it all works

• Form delivery: submit your own contact form from a phone on mobile data. The enquiry should arrive in the team inbox within a minute, and pressing Reply should address the visitor.
• Saved copy: the same enquiry appears under Inbound Messages.
• Spam protection: the Turnstile widget appears on the form, and a test submission still goes through.
• Authentication: open the received email in Gmail, choose Show original, and check that SPF, DKIM and DMARC show PASS.
• Workflow: log in as a test Contributor and confirm they can submit for review but not publish.
• Performance: run the homepage, an article and an Arabic page through PageSpeed Insights on mobile.

Troubleshooting

The WP Mail SMTP test fails with an authentication error

The username or password is wrong, or the provider needs an app password. Use the full email address as the username, reset the mailbox password in cPanel, and try again.

The test hangs or times out

The port or encryption does not match. Try TLS on port 587, then SSL on port 465. Some hosts block outgoing connections to external SMTP servers, so if you use an outside email provider, ask your host whether those ports are open.

The form says "There was an error trying to send your message"

That is Contact Form 7 reporting that the email could not be sent. Check the WP Mail SMTP test first, then check that the form's From address is on your own domain. Flamingo will still have saved the enquiry if it is installed.

Enquiries arrive, but replies go to your own address

The Reply-To header is missing. Add Reply-To: [your-email] under Additional Headers in the form's Mail tab.

The Turnstile widget does not appear

Clear your page cache, check that the keys were pasted correctly in Contact > Integration, and make sure your exact domain is listed under the widget's hostname management in Cloudflare.

Images are not converted to AVIF or WebP

The server may not support the format. The Modern Image Formats plugin falls back to WebP when AVIF is unavailable; if neither works, ask your host whether the server's image library supports WebP.

The one message worth forwarding

Send this to whoever manages your website:

"Please route all website email through authenticated SMTP from a mailbox on our domain, set our form's From to that mailbox with Reply-To set to the visitor, save every enquiry with Flamingo, add Cloudflare Turnstile to our forms, give writers Contributor accounts and editors Editor accounts, convert images with Modern Image Formats, and only load analytics after visitor consent."

The takeaway: a Sharjah content site earns its keep when every enquiry reaches you, spam stays out, your team works within safe roles, and pages stay fast enough that readers stick around long enough to get in touch.