Docs

Create a form in the dashboard, copy its endpoint, point your form at it. That's it — everything below is detail.

Plain HTML

<form action="https://formdock.app/f/your-form-key" method="POST">
  <input type="text" name="name" required>
  <input type="email" name="email" required>
  <textarea name="message"></textarea>

  <!-- honeypot: hidden field that bots fill and humans don't -->
  <input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off">

  <button type="submit">Send</button>
</form>

The browser is redirected to your form's redirect URL (or our thanks page) after submitting.

AJAX / fetch (React, Vue, anything)

const res = await fetch("https://formdock.app/f/your-form-key", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ name, email, message }),
});
const data = await res.json(); // { ok: true, id: "…" }

Send JSON (or set Accept: application/json) to get a JSON response instead of a redirect. CORS is enabled — lock it to your domains in form settings.

Astro / Eleventy / Framer / static sites

Static sites are the sweet spot: no server needed. Use the plain HTML form above anywhere you can edit markup. In Framer, set the form's submit target to your endpoint URL in the form component settings.

Special fields

_redirect — override the post-submit redirect URL per submission.
_subject — set the notification email subject.
_gotcha — the default honeypot field (rename it in form settings). Leave it hidden and empty.
email or _replyto — used as the Reply-To on notification emails and as the autoresponder recipient.

Cloudflare Turnstile

<!-- in <head>: -->
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<!-- inside your form: -->
<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

Enable “Require Turnstile” in form settings and the token is verified server-side on every submission.

Webhooks

Set a webhook URL in form settings. Every non-spam submission POSTs:

{
  "event": "submission.created",
  "form": { "id": "…", "name": "Contact form", "key": "…" },
  "submission": {
    "id": "…",
    "payload": { "name": "Jane", "email": "jane@example.com" },
    "spamScore": 0,
    "createdAt": "2026-07-28T12:00:00.000Z"
  }
}

If you set a webhook secret, each request carries an X-FormDock-Signature header — the hex HMAC-SHA256 of the raw body. Failed deliveries retry five times with exponential backoff.

Spam handling

Three layers: honeypot, optional Turnstile, and keyword/link heuristics. Flagged submissions are stored, not deleted— check the Spam tab and mark false positives as “Not spam”. Spam never triggers emails or webhooks.

Data retention & GDPR

FormDock acts as a data processor for your form submissions. Set a per-form retention window to auto-delete old submissions, delete individual submissions from the dashboard, and export everything as CSV any time. See the DPA.