Your contact form, your server, no per-submission fee.
Form Inbox is the open-source backend for the forms on your static site. Point a form's action at it and you get an inbox, spam filtering that shows its reasons, CSV export and email or Slack notifications. Below, test the spam filter on a message. Everything on this page runs in your browser, so nothing is uploaded.
Try the spam filter
The server uses this exact scoring. At 50 or more a submission goes to the Spam tab, nothing is sent, and the sender still sees a normal thank-you.
Why someone would use this
| Today | Catch | Form Inbox |
|---|---|---|
| Formspree, Basin, Getform, Web3Forms | Submissions are metered per month; spam tools, exports or integrations sit on higher tiers; your visitors' messages live with them | Your server, unlimited forms, everything included |
| Netlify Forms and similar host features | Tied to one host; spam and volume limits come with the plan | Works with any static host, one endpoint URL |
| Your own mail script (PHP, serverless function) | You write, secure and maintain it; no inbox, spam review or export | Tested, escaped, rate limited, with an admin inbox |
Honest limits: no file uploads, no autoresponder to the visitor, no multi-user logins (one admin key), and heuristic spam scoring rather than a trained model: expect to mark a few entries by hand.
Run it yourself
git clone https://github.com/Duncan-Haywood/fp-monorepo && cd fp-monorepo/ventures/form-inbox node --test ADMIN_KEY=$(openssl rand -hex 16) COMPANY_NAME=Acme node server.mjs
Open http://localhost:8080/admin (any user name, ADMIN_KEY as the password), create a form, and paste its snippet into your site. One-click Render deploy and Docker are in the README.
Questions
Why not just use Formspree, Basin, Getform or Netlify Forms?
Those hosted services are polished and the right call if you want zero setup. They meter submissions per month, put spam filtering, file storage or exports on higher tiers, and keep your visitors' messages on their servers. Form Inbox is one small Node server in your own account: unlimited forms and submissions within your disk, spam scoring, CSV export and notifications included. If a free hosted plan already covers your volume, keep it.
How does the spam filter work?
Each submission gets a score from 0 to 100 from transparent signals: a hidden field bots fill in, a form submitted within two seconds of loading, link floods, common spam phrases, disposable email domains, and repeats of a recent submission. At 50 or more it goes to the Spam tab, no notification is sent, and the sender still sees a normal success page so bots learn nothing. Every flagged entry shows its reasons, and you can mark any entry as spam or not spam.
Can anyone post to my form from any website?
Only if you leave Allowed sites empty. Set it to your site's origin and browsers on other sites are refused; requests with no Origin header (curl, servers) are still accepted, so the rate limit and spam score do the rest. Posts are limited to ten a minute per address per form.
Where do notifications go?
Real submissions can ping a Slack or Discord webhook and email the address set on the form through your own Resend account. Email starts in dry-run mode and sends nothing until you set DRY_RUN=false. Spam never notifies.
What does it store?
The fields people submit, a timestamp and the spam score. No IP addresses are written to disk; they are held in memory only to rate limit. Delete a submission or a whole form from the admin page. You are the operator of any form you run and responsible for your privacy notice.