diff --git a/netig.rb b/netig.rb
index 8c3e4ab..c836819 100644
--- a/netig.rb
+++ b/netig.rb
@@ -9,7 +9,7 @@ class Netig < Roda
   plugin :public
   plugin :default_headers, "Content-Type" => "text/html; charset=utf-8"
   plugin :sessions, secret: ENV.fetch("SESSION_SECRET")
-  plugin :route_csrf
+  plugin :route_csrf, csrf_failure: :empty_403
   plugin :hash_branches
   plugin :flash
 
@@ -17,6 +17,7 @@ class Netig < Roda
 
   route do |r|
     r.public
+    check_csrf!
     r.hash_branches
 
     r.root do
diff --git a/routes/contact.rb b/routes/contact.rb
index dd71b3d..638a050 100644
--- a/routes/contact.rb
+++ b/routes/contact.rb
@@ -11,8 +11,6 @@ class Netig
     end
 
     r.post "send" do
-      check_csrf!
-
       form = ContactForm.new(r.params)
 
       if form.spam?