Everything FormHeron actually does

Paste one HTML snippet. No server, no PHP, no serverless function to maintain.

Plain HTML, React, Next.js, Astro, Vue, Svelte, Webflow, Framer, Hugo, Eleventy. It’s just a form action.

Send visitors to any URL on your own domain after submit. Validated at save and at submit time so it can never become a phishing hop.

POST either way. JSON responses carry a stable machine-readable code field for every error.

Included on every plan, free included. Positioned off-screen — not type=hidden, which password managers fill and which flags real people as bots.

Free Cloudflare Turnstile with your keys, so captcha analytics stay in your Cloudflare account. Never a shared sitekey.

Per-IP, per-form and per-account limits enforced in a single atomic database operation — correct under concurrent bot floods.

Spam is stored for review but never counted against your monthly limit and never emailed. A bot flood costs you nothing.

A double-clicked submit button is stored once, counted once, and notified once.

Move every lead New → Contacted → Won → Lost. It’s a pipeline, not an archive.

Label leads and keep a running note per conversation.

Search across every field a visitor submitted, not just name and email.

Download everything, with formula-injection escaping so a malicious submission can’t execute when opened in Excel.

Every payload signed HMAC-SHA256(secret, timestamp + "." + body). Verification snippets for Node, Python and PHP in the docs.

Failed deliveries retry at 1m / 5m / 25m, then dead-letter and email you. Every attempt is logged with status code.

Incoming-webhook URL, stored encrypted.

Point a webhook at Zapier, Make or n8n to reach Sheets, Notion, Airtable or any CRM. Not native — via webhook.

Amsterdam. Operated from India — both stated plainly in our sub-processor list.

Processor DPA available to every account, free included. When your client’s procurement asks, you have an answer.

We store a salted HMAC for rate limiting. A database leak exposes no visitor IPs.

30 / 90 / 365 days by plan, then hard-deleted by an automated job. Not soft-deleted — actually gone.

Per-project JSON export and hard delete from the dashboard, both audit-logged.