html.contact
A full form backend you can test before paying
122 followers
A full form backend you can test before paying
122 followers
html.contact turns plain HTML forms into working email forms with attachments, logs, exports, API access, verified routing, domain allowlists, and spam controls. The Free plan is built so you can test the real setup before upgrading, not just sample a few features.
html.contact
html.contact
Code:
50% OFF forever
*Good for first 10 people who use it!
Congrats on the launch Will. The AI-built sites angle is what got me, half the forms I ship these days are written by Claude against a static page, and wiring them up to a real backend is always the annoying part. One thing I'm curious about since the form key ends up visible in the page source: is the domain allowlist enforced server side, or could someone lift a key and post junk from another domain? Asking because that's the first thing I'd try against my own setup. And the free tier letting you test verified routing before paying is a good call.
html.contact
@vollos 'could someone lift a key': Yes - it is available client side. this was the first big hurdle I had to overcome conceptually as it just feels like a security risk. All other form tools expose a client side key.
'post junk from another domain?' If you mean take your key, put it on their site for a random form, and the submission there ends up in your html.contact inbox - the answer is no. that is not possible. they could try. but this would 100% get blocked on html.contact's end and not count as a submission.
Did you sign up? I suggest trying it out, spent a lot of time on onboarding and making it intuitive.
@hellowilly Signed up just now, and fair enough, the onboarding backs up what you said. Form was live in about a minute, and the answer to my own question was sitting right in the quick start: the allowed-domain step comes before go-live, the key is labeled as public up front, and the default snippet ships with a honeypot field already in it. Keeping the private API keys separate from the public form key is the right split too. Nice work on this one.
html.contact
@vollos You rock!!!!! if you're going to use it on any sites let me know... reply to the welcome email and I can upgrade your account... Thanks, Chalermpon!
@hellowilly Appreciate that, Will. If it ends up on a live site I'll take you up on it. Good luck with the rest of the launch!
How does the verified routing actually work in practice, and does it require setting up SPF/DKIM on my domain or is that handled on your end?
html.contact
@diyarzcuc Nope, verified to whoever you want to send to. Maybe that part should be rewritten. You can send notifications to whoever you want - to / cc / bcc and it verifies the email via a magic link.
Since this is meant for plain HTML forms with no JS framework required, how do the spam controls actually work without something like a CAPTCHA widget? Is it server-side honeypot fields and rate-limiting, or would I still need to bolt on some client-side JS to get real protection against bot spam?
html.contact
@galdayan Unfortunately, yes to client side JS.
I have server side spam filtering. I'll call it pretty decent for most.
Still figuring out who the main users are going to be. At first I assumed non tech people building AI sites...
next week i'll have captcha, h and re. I have cloudflare turnstile implemented its just not pushed live.
Wish there was a way that didn't require more code or scripts for non technical users.... I'm open to suggestions!
How does the attachment size limit work on the free plan, and does the API allow sending through custom domains or only the html.contact subdomain for replies?
html.contact
@tekkanat_f95054 Good point, again i may have to adjust the wording on that - probably a tad confusing.
File attachments up to 4 megabytes. multipart form data for the form... stored securely (only accessible from your dashboard but i give you a quick link to get to it in the email).
but to your point - emails go to whoever you want to/cc/bcc (counts as 1 and spam doesn't count) but you have to verify the domain.
The API is to create forms / download emails etc from your api endpoint. This isn't a sending service like Sendgrid...
hope that clears it up some... you get everything on free so best to just give it a whirl.
How does the Free plan actually work in practice, like is there a limit on submissions per month or any kind of branding injected on the emails sent out?
html.contact
@esmancebacjo1f limit - yes. branding - no. it's about as free as it gets these days. No other form endpoint in the market has as many features (all of them) on the free plan.
Finally something that handles attachments without making me write a backend from scratch. Took about ten minutes to wire up and the verified routing actually felt safe, not just slapped together.
html.contact
@n_yalc43979 Thank you! pretty sure that is the first comment award I've ever given? Means a lot. Reply to the welcome email and i'll hook you up.