Quick Start (5 minutes)
- Sign up at simpleform.dev/register — no credit card required.
- Create a form from your dashboard. You'll get a unique token like
abc123xyz. - Update your HTML — change the form's
actionattribute tohttps://simpleform.dev/f/abc123xyz. - Submit a test entry. Check your inbox and the dashboard.
That's it. Below is the minimum HTML you need.
<form action="https://simpleform.dev/f/YOUR_TOKEN" method="POST">
<input type="text" name="name" required>
<input type="email" name="email" required>
<textarea name="message" required></textarea>
<button type="submit">Send</button>
</form>
How do I configure a form?
Every form has these settings, configurable from the dashboard:
- Email recipients — comma-separated list of addresses to notify.
- Custom subject — subject line for the notification email.
- Redirect URL — where to send the user after a successful submission. Leave blank to show the default thank-you page.
- Allowed domains — restrict submissions to specific origins (one per line).
- Honeypot — on by default. Detects bots filling hidden fields.
- reCAPTCHA v3 — Pro+. Verifies
g-recaptcha-responsewith your secret.
How does spam protection work?
SimpleForm uses three layers, in this order:
- Honeypot fields. Any field whose name starts with
_(e.g._honeypot,_gotcha) is treated as a trap — bots fill them, humans don't see them. - IP rate limiting. Max 10 submissions per IP per endpoint per hour. Returns 429 over the limit.
- reCAPTCHA v3 (optional). Pro+ users can enable Google reCAPTCHA with their own keys.
To add a honeypot to your form:
<input type="text" name="_honeypot" tabindex="-1" autocomplete="off"
style="position:absolute;left:-9999px" aria-hidden="true">
How do I submit via AJAX (no page redirect)?
Just add an Accept: application/json header — the endpoint will return JSON instead of redirecting.
document.querySelector('#myForm').addEventListener('submit', async (e) => {
e.preventDefault();
const form = e.target;
const res = await fetch(form.action, {
method: 'POST',
headers: { 'Accept': 'application/json' },
body: new FormData(form),
});
const data = await res.json();
if (data.success) form.reset();
});
How do webhooks work?
On Pro+ plans, you can attach webhook URLs to any form. Each submission fires a POST to every active webhook with this JSON body:
{
"event": "submission.created",
"form": { "id": 42, "name": "Contact form" },
"submission": {
"id": 1234,
"created_at": "2026-04-25T12:00:00Z",
"data": { "name": "Ada", "email": "ada@example.com" }
}
}
If you set a signing secret, we add an X-SimpleForm-Signature header (HMAC-SHA256 of the body, hex-encoded).
Can I upload files?
Yes — Pro plan supports up to 5 MB per file, Agency up to 25 MB. Use a multipart form:
<form action="https://simpleform.dev/f/TOKEN" method="POST" enctype="multipart/form-data">
<input type="file" name="resume">
<button type="submit">Apply</button>
</form>
API Reference
| Endpoint | Method | Purpose |
|---|---|---|
/f/{token} | POST | Submit a form to a specific endpoint. |
/api/submit.php?token={token} | POST | Same as above (raw form). |
/api/forms.php | GET / POST | List or create forms (auth required). |
/api/submissions.php | GET | Fetch submissions for a form (auth required). |
/api/webhooks.php | GET / POST / DELETE | Manage webhooks (auth required). |
/api/export.php | GET | Export submissions as CSV or JSON. |
Response codes
| Code | Meaning |
|---|---|
| 200 | Submission accepted (or honeypot caught — silently OK) |
| 302 | Redirect to your configured thank-you URL |
| 400 | Missing or invalid form data |
| 402 | Plan submission limit exceeded |
| 403 | Disallowed origin domain |
| 404 | Endpoint token not found or inactive |
| 429 | Rate limit exceeded |
FAQ
Yes, with any host. SimpleForm only needs your form's action attribute to point at a SimpleForm URL.
Yes. We accept standard URL-encoded posts, multipart (for files), and JSON payloads with Content-Type: application/json.
Subject and recipients are customizable per form. Branded email templates and custom domains are coming on the Agency plan.
Pro+ users can export CSV or JSON from the Submissions page. Free users can copy individual submissions.