# Forms for static sites

Collect contact, signup and quote forms on a static site: point the form at /_lobsite/forms/<name> and deploy. Spam filtering, an inbox and email included.

On the web at https://lobsite.com/features/forms

```sh
npx lobsite
```

Deploy the folder; every form that posts to /_lobsite/forms/ is found at deploy time.

A static site has no server to receive a form, so contact forms usually mean a third-party service, a script and an API key. On Lobsite, a form only needs its `action`: point it at `/_lobsite/forms/<name>` and deploy. Messages land in the inbox on your dashboard and in your email, with spam filtered out.

```html
<form action="/_lobsite/forms/contact" method="POST">
  <input name="email" type="email" required>
  <textarea name="message" required></textarea>
  <button>Send</button>
</form>
```

## How it works

1. **Point the form at Lobsite.** `action="/_lobsite/forms/contact"` and `method="POST"`. The last part of the path names the form: `contact`, `newsletter`, `quote`.
2. **Deploy.** The deploy reads your HTML and records every form that posts to `/_lobsite/forms/`; there's nothing to register by hand.
3. **Read the messages** in the dashboard's inbox, in your email (with Reply-To set to the sender), or export them with `lobsite forms export contact --csv`.

The box above starts with a contact page. Publish it to see the form on a live site; it accepts messages once the site is kept in an account.

## Spam protection, built in

When a page is served, Lobsite adds a hidden honeypot field and a signed timestamp to each form. Submissions that fill the honeypot, or arrive within 2 seconds of the page loading, go to a Spam tab instead of the inbox, and a visitor who sends too many in a row is refused. You don't add a captcha or a script for any of it.

## Checks, thank-you pages and JavaScript

Each form can have a section in `lobsite.toml`, which travels with the deploy:

```toml
[forms.contact]
required = ["name", "email", "message"]
types    = { email = "email" }
redirect = "/thanks"
```

- **`required` and `types`** are checked on the server too; a submission that fails isn't stored, and the visitor sees what to fix.
- **`redirect`** shows your own page after sending. Without it, the visitor sees a thank-you page with a link back.
- **Sending with `fetch`** keeps the visitor on the page: post `new FormData(form)` with `Accept: application/json`, and the answer is `{"ok": true}` or the fields that didn't pass.
- **Frameworks** work when the form is in the built HTML, which prerendering and static export produce (Astro, Eleventy, Next.js with `output: "export"`, SvelteKit with `prerender`).

Full examples (newsletter, quote request, the fetch script) are in the [forms docs](https://lobsite.com/docs/forms).

## What each plan includes

| | Without an account | Free | Paid (coming soon) |
|---|---|---|---|
| Accepts submissions | Once the site is claimed | Yes | Yes |
| Submissions a month, per site | — | 25 | No cap |
| Email notifications | — | Your account email | Any verified address |
| Signed webhooks | — | No | Yes |
| Kept for | — | 90 days | 1 year |

Preview URLs never accept submissions, and file uploads in forms aren't supported yet.

## Lobsite forms, a form service, or your own backend

| | Lobsite forms | A form backend service | Your own backend |
|---|---|---|---|
| What you add to the page | The `action` | The service's endpoint, often a key or script | Your endpoint |
| Accounts to manage | The one your site is in | A second one | A server or functions host |
| Spam filtering | Built in | Varies by service and plan | You build it |
| Rolls back with the site | Yes: settings live in `lobsite.toml` | No | Depends |
| Free volume | 25 a month per site | Varies by service | Your hosting costs |
| Webhooks | Paid plan, coming soon | Usually | Yes |

If you need hundreds of submissions a month today, or file uploads, a dedicated service is the better fit until the paid plan launches. For a contact form on a small site, the `action` is all it takes.

## Frequently asked questions

### Do Lobsite forms need JavaScript?

No. A plain HTML form works as it is. JavaScript is optional, for showing a message without leaving the page.

### Why did my form's message go to Spam?

Most often the form was rendered by JavaScript in the browser, so it lost the hidden spam fields Lobsite adds when serving the page. Keep the form in the built HTML, and let the browser submit the form as served.

### Can I get messages at a different email address?

On the free plan, notifications go to your account's email. Any verified address comes with the paid plan, which is coming soon.

### Does a site without an account accept form messages?

Not yet: the deploy works, with a warning, and the form starts accepting messages once you claim the site into a free account.

### Can I have several forms on one site?

Yes. Each name is its own form, with its own messages and settings: `/_lobsite/forms/contact` and `/_lobsite/forms/newsletter` stay apart in the inbox and in exports.