Forms

Forms puts contact forms on your website, emails you each message and keeps them all in one inbox.

What you get

• Build a form in the admin: pick fields (short text, email address, phone number, long text, drop-down list, tick box), rename them and put them in order.
• Or use a form your developer built. Its messages come in the same way.
• An email for each new message, to one or more addresses. Replies go straight to the person who wrote.
• An optional thank-you email to the person who filled in the form.
• An inbox with every message, even when an email didn't go out. Mark them as handled or delete them.
• An overview of how many messages came in each day and which forms people used.

Spam protection built in

Forms uses Cloudflare Turnstile, which is free, to check that a person sent each message. Most people never see a puzzle. A hidden trap field and a limit per visitor each hour keep robots out too.

What you need

• A free Cloudflare account for Turnstile. The setup page walks you through it.
• An email service on your website, like our Emails app, to get messages by email. Without one they're still kept in your inbox.

Does it cost anything?

Forms is free, and so is Cloudflare Turnstile.

Why aren't my forms taking messages?

Forms only take messages once spam protection is set up in the Settings tab. Check too that the form is switched on (Form is live, on the form's Settings tab).

I'm not getting emails for new messages.

Your website needs an email service, like our Emails app. Until it has one, every message is still kept under Submissions, and the Forms page tells you emails aren't going out.

Can I put the person's answers in the email?

Yes. Use the name of any field in curly brackets, like {name} or {phone}, or {all_fields} for every answer.

Why can't the thank-you email repeat what people typed?

So nobody can use your form to send their own words or links to someone else from your address. It can use {name}, {form}, {site} and {date}, and goes to each address at most once a day.

How many messages can one person send?

5 an hour by default. You can change it in Settings. Their IP address is never stored.

What happens to messages when I delete a form?

They stay in your inbox.

What Forms can do

• Connect to one place only: Cloudflare Turnstile (challenges.cloudflare.com), to check that a person sent each message.
• Send emails through your website's email service: the message to you and the optional thank-you.
• Take messages from visitors on your website. It can't read or change your content, media or users.

Your Turnstile keys

• The Secret Key is stored encrypted and never shown again. It can only ask Cloudflare whether a visitor is a person.
• Turning spam protection off also switches your forms off.

Keeping robots out

• Nothing is accepted until Turnstile is set up, and a message is refused if Cloudflare can't be reached.
• A hidden trap field, answers checked for length and format, and a limit per visitor each hour.
• The thank-you email never repeats what was typed, so your form can't be used to send spam from your address.

What Forms keeps

Your forms, and each message: the answers, the page it came from and whether its email went out. Visitors are counted by a scrambled (hashed) IP address, cleared after two days; IP addresses are never stored.

Only people who can manage plugins in your admin can see the Forms page.

Reporting a problem

If you find a security problem, please email jason@alpineux.com instead of posting it publicly.

0.1.0

• First release.

1. Click Install and confirm.
2. Open Forms in the admin menu, under Apps, and go to the Settings tab.
3. Click Open Turnstile and sign in to Cloudflare. If it asks which account to use, choose the one your website is in.
4. Click Add widget, give it a name like Website forms, and add your website's address under hostnames. Leave the other choices as they are and click Create.
5. Copy the Site Key and Secret Key into Forms and click Turn on. Your forms only take messages once this is done.
6. Click + New form, give it a name and choose Build it here or Use my own form.
7. Choose who gets new messages on the form's Emails tab.

Building a form here? Its page shows the line whoever looks after your website adds where the form should go. Using your own form? Its page shows code to send to your developer.

Before you start

Your website needs an encryption key set up (EMDASH_ENCRYPTION_KEY), because Forms stores your Turnstile Secret Key encrypted. To get messages by email, install and connect an email service like Emails.