Contact form without a backend

“No backend” means you do not run mail code. Something still has to accept the POST, filter spam, store the payload, and notify you. That something is a form backend service.

Why not mailto: or Google Forms

• mailto: exposes addresses and fails on many mobile clients
• Google Forms is not your brand and is awkward to style or brand
• Serverless mail handlers leave you owning secrets, spam, retries, and deliverability

Minimum viable form backend

1. Public form key with submit-only capability (no read access to leads)
2. Hard payload caps (size, field count, depth)
3. Rate limits that stay correct under concurrency
4. Honeypot and optional captcha with your own keys
5. Email without becoming an open relay
6. A dashboard when email is not enough

FormHeron is built around that list: spam-first pipeline, lead inbox (status, search, tags/notes on paid plans), HMAC webhooks, Slack, EU database storage, export/delete. What we deliberately do not ship: autoresponder to submitters, file uploads, drag-and-drop form builder, reCAPTCHA, native Google Sheets.

Example: zero server code

<form action="https://formheron.com/f/YOUR_KEY" method="POST">
  <label for="email">Email</label>
  <input id="email" type="email" name="email" required />

  <label for="message">Message</label>
  <textarea id="message" name="message" required></textarea>

  <!-- Honeypot: off-screen text field, not type=hidden -->
  <input type="text" name="_hp" tabindex="-1" autocomplete="off"
         aria-hidden="true" style="position:absolute;left:-9999px" />

  <button type="submit">Send</button>
</form>

That is the entire integration for many sites. Host the HTML anywhere. Leads land in FormHeron. See platforms for Next.js, React, Webflow, and others.

When you still need your own code

Use a thin Server Action or API route only if you must enrich the payload before storage (auth check, CRM id, A/B flag). Prefer calling FormHeron with fetch rather than inventing SMTP. Webhooks are the right extension point for CRM and Sheets — see send form submissions to Google Sheets (via Zapier/Make, not native).

Cost and plans

Free: 250 submissions/month, email + inbox, honeypot always on. Indie ($9): webhooks, Slack, tags, notes, 3,000/month. Pro ($19): higher limits, CSV export, 3 webhooks per form. Full matrix on pricing.

Security boundaries you should expect

A public form key is a submit-only capability. Possession of it must never allow reading other people’s leads. Ownership checks on dashboard APIs must always use the session user id, not a client-supplied user id. Webhooks must be signed. Secrets (webhook signing keys, Turnstile secrets, Slack URLs) must be encrypted at rest.

FormHeron is built that way. You still own what fields you collect and how long you keep copies in your own tools after webhook delivery. Prefer not to collect special-category data through open web forms.

Migration from host-locked form products

1. Create a FormHeron form and copy the public key
2. Replace the host form action with the FormHeron URL
3. Add the honeypot field
4. Recreate notification email and optional Slack/webhooks
5. Point DNS/docs at the new thanks page if you used a host-specific success state
6. Remove dual handlers (Netlify Forms attributes, old serverless mail routes)

Next: docs quickstart, features, or start free.