DEV Community: Alen | SmartForm AI

How to Handle Form Submissions in Node.js and Express (Without Writing Spam Logic)

Alen | SmartForm AI — Tue, 10 Nov 2026 13:11:47 +0000

The first Express contact form I shipped was about 140 lines. Multer for multipart parsing, express-validator for the field checks, a honeypot field I hoped bots would fill, a Redis rate limiter, and a half-finished isSpam heuristic that mostly flagged legitimate customers from Singapore.

Then a bot filled the form 400 times in a night. It was a "SEO services" spam that slipped past because I'd hardcoded a keyword blocklist instead of classifying the message.

✅ The short version

Post your Express form to a form backend endpoint and the spam filtering, intent classification, and notifications happen on their side. Or point a webhook at your Express app and receive already-processed submissions. Your Express code becomes "receive data" instead of "defend against spam."

What an express form backend actually costs you

Here's the realistic dependency list for a production Express form endpoint:

npm install express multer express-validator express-rate-limit dotenv

And the code that comes with it:

// The version you'll write yourself. Every project, every time.
const multer = require("multer");
const { body, validationResult } = require("express-validator");
const rateLimit = require("express-rate-limit");

const upload = multer({ dest: "uploads/" });

const formLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
});

app.post("/api/contact", formLimiter, upload.single("attachment"), [
  body("email").isEmail().normalizeEmail(),
  body("message").trim().isLength({ min: 10, max: 2000 }),
  body("website").optional({ values: "falsy" }), // the honeypot
], async (req, res) => {
  const errors = validationResult(req);
  if (errors.array().length) {
    return res.status(422).json({ ok: false, errors: errors.array() });
  }

  // ...and now the part nobody can skip: deciding if it's spam.
  const message = req.body.message.toLowerCase();
  const spamWords = ["seo services", "crypto", "backlinks"];
  if (spamWords.some((w) => message.includes(w))) {
    return res.json({ ok: true }); // silently drop
  }

  await db.insert({ ...req.body, created_at: new Date() });
  await mailer.send({ to: "sales@example.com", text: req.body.message });
  res.json({ ok: true });
});

That code works. It's also the part of your app most likely to break silently — the spam filter is a blunt instrument, the rate limiter needs Redis to be useful across instances, and multer writes attacker-controlled filenames to disk if you forget to sanitize them.

Option 1: Node.js form submission via POST from your Express route

The endpoint is a plain public HTTP endpoint. No SDK, no special client library.

// server.js
const express = require("express");
const app = express();
app.use(express.json());

const FORM_ID = process.env.SMARTFORM_FORM_ID;
const API_KEY = process.env.SMARTFORM_API_KEY; // workspace-level key (optional)

app.post("/api/contact", async (req, res) => {
  const { name, email, message } = req.body;

  if (!email || !message) {
    return res.status(422).json({ ok: false, error: "email and message required" });
  }

  const payload = {
    name,
    email,
    message,
    // Reserved fields — see the docs
    _next: "https://yourapp.com/contact?sent=1",
    _subject: `New contact form message from ${name || "someone"}`,
    _gotcha: "", // honeypot — leave empty for real users
  };

  const headers = { "Content-Type": "application/json", Accept: "application/json" };
  if (API_KEY) headers["X-Api-Key"] = API_KEY;

  const upstream = await fetch(
    `https://api.usesmartform.com/api/v1/f/${FORM_ID}`,
    { method: "POST", headers, body: JSON.stringify(payload) }
  );

  if (!upstream.ok) {
    return res.status(502).json({ ok: false, error: "upstream form service rejected the request" });
  }

  const result = await upstream.json();
  res.json({ ok: true, submissionId: result.submission_id });
});

app.listen(3000);

Two things worth noting.

First, the workspace API key in X-Api-Key is optional. Without it, requests go through the same per-IP rate limit that protects browser-submitted forms (100 submissions per IP per hour). With it, server-to-server traffic skips the IP limit — which matters if your Express app sits behind a shared NAT or a corporate proxy.

Second, the response comes back with is_spam and intent:

{
  "success": true,
  "submission_id": "sub_9f2c1a8e4b",
  "is_spam": false,
  "intent": "sales"
}

So you can branch on it if you want. Most people don't — they return { ok: true } to the browser and let the webhook handle the routing.

💡 Why spam submissions don't cost you quota

SmartForm AI's honeypot catches the obvious bot traffic before it reaches the AI classifier, and the classifier catches the rest. Neither path burns a submission from your monthly quota. That's the difference between a form backend and a raw POST endpoint — you're not renting the spam problem, you're forwarding it.

Option 2: A nodejs contact form where the browser POSTs directly

If your Express app serves a page with a contact form, you may not need a proxy route at all. Point the form's action at the endpoint:

<form action="https://api.usesmartform.com/api/v1/f/YOUR_FORM_ID" method="POST">
  <input name="name" type="text" required />
  <input name="email" type="email" required />
  <textarea name="message" required></textarea>

  <!-- Honeypot: hidden from humans, tempting to bots -->
  <div style="position:absolute;left:-9999px" aria-hidden="true">
    <label>Leave this empty<input name="_gotcha" tabindex="-1" autocomplete="off" /></label>
  </div>

  <!-- Where the browser lands after a successful submit -->
  <input type="hidden" name="_next" value="https://yourapp.com/contact?sent=1" />

  <button type="submit">Send</button>
</form>

Your Express server never touches the form. The tradeoff: the endpoint URL is visible in the HTML (which is fine — form_id is a random 8-character string, not a secret), and you lose the chance to add your own server-side logic to the request path.

Option 3: Receive processed submissions via webhook (express webhook form handler)

This is the pattern I use when the form data needs to end up somewhere in my app — creating a ticket, enriching a CRM record, posting to a chat channel. You configure a webhook URL on the form in the dashboard, and SmartForm AI POSTs the finished submission to your Express server.

// routes/webhooks.js
const express = require("express");
const crypto = require("crypto");
const router = express.Router();

// Express needs the raw body to verify the HMAC signature.
router.post("/webhooks/smartform",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.get("X-SmartForm-Signature") || "";
    const expected = crypto
      .createHmac("sha256", process.env.SMARTFORM_WEBHOOK_SECRET)
      .update(req.body)
      .digest("hex");

    const provided = signature.replace(/^sha256=/, "");
    const valid =
      provided.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(provided), Buffer.from(expected));

    if (!valid) {
      return res.status(401).json({ error: "invalid signature" });
    }

    const payload = JSON.parse(req.body.toString("utf8"));
    const { submission, form } = payload;

    if (submission.is_spam) {
      // Quietly archive. Don't page the on-call for spam.
      return res.status(200).json({ received: true });
    }

    console.log(`[${form.name}] ${submission.intent_label}: ${submission.ai_summary}`);
    res.status(200).json({ received: true });
  }
);

module.exports = router;

The express.raw() middleware is the detail people miss. If express.json() runs first, it consumes and re-serializes the body, and the HMAC check fails because the bytes changed. Register the raw parser on the webhook route before any global JSON parser.

The payload itself carries everything the AI pipeline produced:

{
  "event": "submission.created",
  "submitted_at": "2026-11-01T09:14:22.481Z",
  "form": { "id": "a1b2c3", "form_id": "kX9mN2pQ", "name": "Website contact" },
  "submission": {
    "id": "9f2c1a8e4b",
    "data": { "name": "Alice", "email": "alice@example.com", "message": "..." },
    "is_spam": false,
    "spam_confidence": 0.04,
    "intent_label": "sales",
    "intent_confidence": 0.91,
    "is_high_value": true,
    "ai_summary": "Enterprise pricing inquiry from Acme Inc. for 50 seats.",
    "ip_address": "203.0.113.9",
    "user_agent": "Mozilla/5.0 ..."
  }
}

That ai_summary and intent_label are the payoff. A "route this to sales vs support" decision that would have been a string-matching guess in your own code is already made, on a model that reads the actual message.

Which pattern should you pick?

You need	Use
Just store the submission and notify yourself	Browser POSTs straight to the endpoint
Custom logic before the submission is recorded	Express proxy route (Option 1)
Send the data into another system	Webhook into your Express app (Option 3)

You can also combine them: browser → Express proxy → endpoint, plus a webhook back into Express for the enrichment step. The proxy handles rate limiting and field normalization; the webhook gives you the AI verdict.

The part you don't have to write

The reason I stopped maintaining my own spam filter wasn't that reCAPTCHA is bad — it's that spam detection is a moving target. The keyword list that worked last quarter now blocks two real customers a week. The honeypot that caught 90% of bots last year now catches 40%.

SmartForm AI runs that classification server-side on every submission, and the part that matters for cost: spam doesn't count against your submission quota. You can be as aggressive with the filter as you want without your bill going up, which is exactly what you can't say about a filter you host yourself, where every rejected request still costs you a CPU cycle.

If you want to see the shape of the payloads before wiring anything up, the playground lets you fire a submission at the endpoint and read the response and webhook body back.

For the Python side of the same problem — Django and Flask specifically — I wrote a guide to that too. And if you want to push these submissions somewhere other than your app, the webhook automation guide covers Slack, Notion, and Telegram.

I Added a Contact Form to an Astro Site Without a Backend

Alen | SmartForm AI — Tue, 27 Oct 2026 03:15:27 +0000

I moved a client's marketing site to Astro a few weeks ago. Astro 7 was the reason — the Rust compiler and stable route caching cut the build from ~4 minutes to about 90 seconds. Fast builds were the whole point.

Then I hit the one thing Astro can't do out of the box: accept a contact form submission.

Here's the honest version of what I tried, what worked, and the two gotchas that cost me an afternoon.

Why Astro forms trip people up

Astro is component-first and ships almost zero client-side JavaScript. Most "add a form" tutorials assume a Node runtime. Three things follow from that, and they're the reason this feels different from a Next.js or Rails form:

A form has to POST somewhere. The action attribute is just a URL. There's no "submit to Astro" without an adapter.
Astro Actions need a server adapter. They're stable and genuinely type-safe, but they require output: 'server' or 'hybrid' plus @astrojs/vercel / netlify / cloudflare / node. On the default output: 'static' build, they don't run.
No spam filtering is included. Neither Actions nor a plain <form> ships with detection. That's on you.

What I tried (and why I backed out)

Astro Actions. Beautiful DX, end-to-end typed. But to handle one 3-field contact form I had to flip output: 'static' to 'server', add an adapter, manage secrets, and accept cold starts. My "static site" now had a server. That's a lot of surface area for a page that asks for a name, an email, and a message.

Netlify Forms. Five minutes, genuinely nice — but the site was on Vercel, so it was a non-starter. The lock-in matters more than the price tag.

Cloudflare Turnstile + Workers. Turnstile is a great CAPTCHA (free, accessible, no image grids). But to use it on Vercel I now maintain a Worker. I'd traded an adapter for a different server to maintain.

What actually shipped: a plain HTML form POSTing to an external endpoint. No adapter, no server, no secrets.

The form

This is the entire integration. src/components/ContactForm.astro:

<form
  action="https://api.usesmartform.com/api/v1/f/YOUR_FORM_ID"
  method="POST"
>
  <label for="name">Name</label>
  <input id="name" name="name" type="text" required minlength="2" />

  <label for="email">Email</label>
  <input id="email" name="email" type="email" required />

  <label for="message">Message</label>
  <textarea id="message" name="message" rows="6" required minlength="10"></textarea>

  {/* Honeypot — bots fill it, humans never see it */}
  <input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off" />

  {/* Where to send the browser after a successful submit */}
  <input type="hidden" name="_next" value="https://yoursite.com/thanks" />

  <button type="submit">Send Message</button>
</form>

Drop it in a page and you're done. Astro's whole pitch is zero JS by default, and a method="POST" form navigates to the endpoint and back — the service returns a 302 to your _next URL. No client-side state, no hydration cost, no framework.

It doesn't matter whether the surrounding page is an Astro component or a React/Vue/Svelte island. As long as the rendered DOM contains <form action="..." method="POST">, the submission lands.

Gotcha #1: the `Accept` header

If you want an inline success message instead of a page redirect, use fetch. The first version I wrote returned a 302, and fetch followed it cross-origin into a CORS error that looked like a server outage.

const res = await fetch("https://api.usesmartform.com/api/v1/f/YOUR_FORM_ID", {
  method: "POST",
  body: new FormData(form),
  headers: { Accept: "application/json" }, // ← required
});

if (res.ok) {
  const data = await res.json();  // includes next_url
  status.textContent = "Thanks — we'll get back to you shortly.";
  form.reset();
}

Always send Accept: application/json. You get JSON back (including next_url) instead of a redirect.

Gotcha #2: the honeypot needs three attributes

display:none alone isn't enough. I had style="display:none" and still saw bots post clean submissions, because they'd learned to skip hidden inputs. Adding tabindex="-1" (keeps it out of keyboard nav) and autocomplete="off" (keeps password managers out) closed the gap.

To actually test the filter I removed the honeypot for a day, watched bot traffic arrive, then put it back and watched those same submissions get dropped server-side — silently, with no email and no quota deduction.

Spam: layer it, don't pick one

Method	Free	User friction	Catches
Honeypot field	Yes	None	The dumbest bots
Cloudflare Turnstile	Yes (≤20 widgets)	Almost none	Browser-level bots
reCAPTCHA v3	Yes (≤1M/mo)	None	Script bots, but flags real users sometimes
ML filter (server-side)	Yes	None	Targeted / scripted spam

What I ended up with: honeypot as the cheap first layer, a server-side classifier behind it, and Turnstile in front only on the demo-request form where a false positive costs us a lead.

When I'd use Astro Actions instead

If you already have output: 'server' and an adapter, use Astro Actions. If you're tying submissions to a logged-in user, or the form writes to your database, Actions is the right tool. I'm not against it — I just didn't want to add a server to a static site for one contact form.

It's also fine to mix. That site uses Actions for in-product feedback and an external endpoint for the marketing contact form. They're independent.

Verdict

For a static Astro site with one marketing form, the whole thing should be ~20 lines of HTML and zero infrastructure. That's what I shipped. The hosted-service part is my own tool, so treat that section as biased — but the underlying pattern (a plain POST to an endpoint) works with any provider, including one you run yourself.

I didn't want to write this as a sales pitch, but full disclosure: the external endpoint I used is my own product, SmartForm AI. The plain POST pattern works with any provider. If you want the full comparison matrix, I put the long-form version on my blog (linked in the comments).

Happy to answer questions in the comments.

Form Backend Pricing in 2026: What Actually Costs You Money

Alen | SmartForm AI — Mon, 12 Oct 2026 18:55:36 +0000

The short version. At 5,000 submissions/month, SmartForm AI Pro is $9.90 ($1.98 per 1K), Forminit Pro is $19 ($3.80 per 1K), Basin Pro is $40.83 ($8.17 per 1K), and Formspree's cheapest tier with webhooks is $30/month but caps at 2,000 submissions. Netlify Forms is genuinely free — if your site is hosted there.

Form backend pricing pages have a specific problem: the headline number is almost never the number you pay.

I've seen this pattern repeat across a dozen static sites, so I went back and re-verified every major vendor's pricing page in October 2026. Several numbers that are quoted everywhere turned out to be badly outdated — one vendor had rebranded entirely, another had made its free tier unlimited, and a third no longer sells the tier names most comparison posts still reference.

This is the corrected version.

Why re-verify pricing at all?

Because form backend pricing churns hard. In the last six months:

Netlify moved to credit-based plans (April 2026) and made Forms free and unlimited.
Getform rebranded to Forminit (January 2026) with an entirely new pricing structure.
Formspree retired Bronze / Gold / Platinum in favor of Personal / Professional / Business, and moved AI spam filtering from a paid add-on into every paid tier.

Any comparison post older than that is going to mislead you. So this one has a date on it, and I'll note the verification date rather than pretending these numbers are permanent.

TL;DR by volume

Your monthly volume	Cheapest option with webhooks	Cost
Under 200/mo	SmartForm AI Free or FormSubmit (no webhooks)	$0
200 – 5,000/mo	SmartForm AI Pro	$9.90
5,000 – 50,000/mo	SmartForm AI Business	$19.90
Over 50,000/mo	Contact sales or self-host	Negotiated

Real monthly cost comparison

Cheapest plan that actually covers the volume:

Monthly submissions	SmartForm AI	Formspree	Netlify Forms	Basin	Forminit
50	$0 (Free, 200/mo)	$0 (Free, 50/mo)	$0¹	$0 (Free, 50/mo)	$0 (Free, 100/mo)
200	$0 (Free, 200/mo)	$15 (Personal)	$0¹	$12.50 (Starter)	$0 (Free — over cap)
1,000	$9.9 (Pro)	$15 (over 200 cap)	$0¹	$12.50 (over 250 cap)	$19 (Pro)
5,000	$9.9 (Pro)	$30 (Professional, only 2,000)	$0¹	$40.83 (Pro)	$19 (Pro)
25,000	$19.9 (Business)	$60 (Business, only 20,000)	$0¹	$108.33 (Agency)	$49 (Business, only 10,000)
50,000	$19.9 (Business)	$60 (Business, only 20,000)	$0¹	Contact sales	$99 (Volume)
100,000	Contact sales	Contact sales	$0¹	Contact sales	Contact sales

¹ Netlify Forms is free and unlimited on credit-based plans (default since April 2026). Legacy plans still have the 100 submissions/month cap.

The Netlify asterisk is doing a lot of work

Netlify's Forms really are free and unlimited. But there are two conditions:

You're on a credit-based plan (the default now).
Your site is hosted on Netlify.

Condition 2 is the one that catches people. Netlify's build pipeline is what processes data-netlify="true" on your form. Deploy that same site to Vercel or Cloudflare Pages and the form simply doesn't exist. It's not "free hosting" — it's "free if you already chose this host."

What each service actually charges

SmartForm AI

Tier	Monthly	Submissions	Forms	Seats	AI filtering	Webhooks	API keys	Audit log
Free	$0	200	3	1	spam only	❌	❌	❌
Pro	$9.9	5,000	Unlimited	1	spam + intent	✅ HMAC + 3× retry	✅	30 days
Business	$19.9	50,000	Unlimited	10	spam + intent	✅ + custom rules	✅	365 days

The honest caveat: Free has no webhooks and no API keys. It's a hosted inbox with spam filtering, not a programmable endpoint. If you need to push submissions into a CRM, you start at $9.90. Pro includes AI filtering and webhooks at the same price, which is the part that makes it competitive.

At the cap, submissions are refused with HTTP 402 and error_code: PLAN_QUOTA_EXCEEDED. No auto-upgrade, no surprise overage invoice.

Formspree

Tier	Annual	Monthly	Submissions	AI spam filter	Webhooks	File uploads
Free	$0	$0	50	✅ basic	❌	0 GB
Personal	$10	$15	200	✅ basic	❌	1 GB
Professional	$20	$30	2,000	✅ + advanced control	✅	5 GB
Business	$60	$90	20,000	✅ + custom rules	✅	10 GB

Two things that have changed and that most posts still get wrong:

AI spam filtering is no longer a paid add-on. Formshield ML ships on every paid plan. If you see a "$9/mo AI add-on" in a comparison, it's out of date.
There is no 5,000-submission tier. Professional caps at 2,000; the next step is Business at 20,000 for $60/mo annual. So if you need 5,000/mo with webhooks, you pay $60 for a tier with 4× the volume you need.

What genuinely is gated: webhooks, autoresponders, and API access all start at Professional.

Netlify Forms

Plan	Monthly	Submissions	Spam filtering	Cross-platform
Free (credit)	$0	Unlimited	Honeypot + reCAPTCHA	❌ Netlify only
Personal (credit)	$9/seat	Unlimited	Honeypot + reCAPTCHA	❌ Netlify only
Pro (credit)	$20/seat	Unlimited	Honeypot + reCAPTCHA	❌ Netlify only
Legacy plans	Varies	100/mo	Honeypot + reCAPTCHA	❌ Netlify only

No per-seat multiplier on form submissions — you pay Netlify for hosting, not for forms. Webhook delivery goes through Netlify Functions and consumes credits.

The real cost isn't the money, it's the lock-in: moving hosts means rebuilding the form, and historical submission data lives in Netlify's backend (manual CSV export to get it out).

Basin

Tier	Annual	Submissions	Storage	AI features	Zapier	Webhooks
Free	$0	50	100 MB	❌	✅	❌
Starter	$12.50	250	500 MB	❌	✅	❌
Growth	$24.17	1,000	2 GB	❌	✅	✅
Pro	$40.83	5,000	10 GB	✅ AI lead agent	✅	✅
Agency	$108.33	25,000	50 GB	✅	✅	✅

Basin has the best Zapier / Make / n8n story here, and its overage behavior is the friendliest: forms keep working past your cap and you're billed at tiered rates starting around $5.25 per 1,000 extra submissions.

The catch is the AI features start at Pro ($40.83/mo), and 25,000 submissions costs $108.33 — 5× SmartForm AI Business for half the volume.

Forminit (formerly Getform)

Getform rebranded to Forminit on 14 January 2026 — same team, same product, not an acquisition. Existing getform.io endpoints still work.

Tier	Monthly	Submissions	Forms	Storage	AI spam filter	Webhooks
Free	$0	100	1	100 MB	❌	❌
Pro	$19	5,000	5	1 GB	❌	✅
Business	$49	10,000	15	5 GB	❌	✅
Volume	$99	50,000	Unlimited	10 GB	❌	✅

Genuinely nice: unlimited submission archive on every plan (including Free), typed server-side validation via Form Blocks, and both public and API-key-protected submission modes.

But the limit behavior is the harshest in this comparison — Forminit's docs state that submissions sent while a form is paused are not stored or queued. At your cap, your form stops and the submissions are gone.

Cost per 1,000 submissions

The cleanest way to see the tier gaps:

Service	Monthly $ / volume	Cost per 1K
SmartForm AI Free	$0 / 200	$0
SmartForm AI Pro	$9.9 / 5,000	$1.98
SmartForm AI Business	$19.9 / 50,000	$0.40
Netlify Forms (credit plan)	$0 / unlimited	$0
FormSubmit (free tier)	$0 / unlimited	$0
FormSubmit (paid credits)	$100 / 1,000	$100.00
Forminit Pro	$19 / 5,000	$3.80
Formspree Business	$60 / 20,000	$3.00
Basin Pro	$40.83 / 5,000	$8.17
Formspree Professional	$30 / 2,000	$15.00

The three $0 rows all come with real constraints: SmartForm AI Free caps at 200/mo with no webhooks, Netlify requires Netlify hosting, and FormSubmit is email-only with no filtering.

Of the paid options that include webhooks, SmartForm AI Pro at $1.98 per 1K is the cheapest — about half of Formspree Business, a fifth of Basin Pro, and nearly 8× cheaper than Formspree Professional.

On FormSubmit's paid model

Worth calling out because it's unusual: FormSubmit has no monthly subscription plans. You buy credits at $0.10 per submission (cheaper at volume), credits never expire, and spam doesn't cost a credit. Email notifications cost +1 credit and are off by default. Forms are unlimited.

At 1,000 submissions/month that's about $100/month, which makes it a pay-as-you-go safety valve rather than a real form backend.

What happens when you hit the limit

This is the detail most comparison posts skip, and it's the one that decides whether a price spike costs you a few dollars or a few leads:

Service	Behavior at the cap
SmartForm AI	Submissions refused with HTTP 402. No auto-upgrade, no overage billing.
Formspree	Stops accepting submissions, prompts an upgrade
Netlify Forms	Nothing — unlimited on credit plans
Basin	Keeps accepting and bills the overage
Forminit	Forms pause and the submissions are discarded (not stored or queued)
FormSubmit	Free tier keeps accepting; paid credits just run out

If losing a lead silently is worse for your business than showing an error, that ranking matters more than the price column.

Recommendations by scenario

Personal blog, under 200/mo → SmartForm AI Free ($0) or FormSubmit ($0). Both free; SmartForm AI adds filtering and a dashboard.

SaaS site, 200 – 5,000/mo, needs webhooks into a CRM → SmartForm AI Pro ($9.90). The cheapest place webhooks and AI filtering exist together. Formspree's equivalent is $30/mo monthly and caps at 2,000.

High-volume B2B or e-commerce, 5,000 – 50,000/mo → SmartForm AI Business ($19.90), which includes 10 seats and a 365-day audit log. Basin charges $108.33 for 25,000; Forminit charges $49 for 10,000.

Over 50,000/mo → Talk to sales or self-host. At that volume you want SLA terms and compliance guarantees.

The part pricing pages never mention

The line item that actually costs you money isn't the subscription — it's the leads your filter throws away.

If a real customer gets classified as spam, they're gone. They won't submit twice. That's why SmartForm AI exposes spam_confidence and intent_confidence in the webhook payload: you can set thresholds per form rather than accepting a global default, which is how you keep a false positive from eating your highest-value inquiry while still blocking obvious junk.

The other hidden cost is engineering time. If your backend has no ML filtering, someone on your team is reading spam — setting up honeypots once, then triaging forever. A couple of hours a month that never shows up on an invoice but never goes away either.

FAQ

Q: Does Formspree still charge $9/mo for AI filtering?
No. That add-on is gone — basic ML filtering (Formshield) is included on every paid plan. What costs extra is the tier: webhooks, autoresponders, and API access require Professional ($30/mo monthly) or above.

Q: Is Netlify Forms really unlimited now?
On credit-based plans, yes — Netlify's docs state "For credit-based plans, Forms are free and unlimited." The 100 submissions/month cap still applies to legacy plans. The catch is you must be hosting on Netlify.

Q: Is Getform the same as Forminit?
Yes. Getform was renamed Forminit on 14 January 2026. Same team, same product, existing endpoints still work. Pricing changed, so older comparisons are wrong.

Q: What happens if I exceed my SmartForm AI limit?
Submissions are refused with HTTP 402 and error_code: PLAN_QUOTA_EXCEEDED. There's no automatic upgrade and no overage billing — you upgrade manually. I find this preferable to a surprise invoice, but it's a real difference from Basin, which bills overages instead of blocking.

Q: Which is cheapest for a one-time landing page?
FormSubmit, at $0, with no account setup. If you expect more than a handful of submissions or want any filtering, use SmartForm AI Free — also $0, with a dashboard and AI spam filtering.

Pricing verified against vendor websites in October 2026. Form backends move fast — if you spot something that's drifted, drop a comment and I'll update it.

5 Formspree Alternatives Worth Switching to in 2026 (An Honest Comparison)

Alen | SmartForm AI — Mon, 05 Oct 2026 02:33:43 +0000

Last year I moved a yoga studio onto Astro. Their contact form ran on Formspree's free tier, and they burned through all 50 monthly submissions in the first week — almost entirely Russian spam.

Nobody noticed. Not the studio owner, not the visitors. Formspree doesn't throw an error; it just stops accepting. For the remaining three weeks that "Book a session" form didn't exist.

Formspree's ads say $8/mo. Another client's invoice was $90. Not their fault — I just hadn't understood how their pricing is structured.

(For the record, the yoga studio ended up on Forminit. Not because it's the best fit — because she needed file uploads for class schedules, and at 40 submissions a month nothing else mattered. Sometimes the right answer is the boring one.)

I'm Alen, and I build SmartForm AI, a form backend for static sites. So this post is biased by construction. I'll try to be straight about where each competitor genuinely wins, and I'll tell you what's wrong with my own product too. All pricing below was re-checked against vendor pages in October 2026.

How I tested: one real 5-field contact form on a static site, then roughly 500 synthetic submissions pushed through each service, 30% of them spam. I cared most about three things — what happens to a submission when the filter is wrong, what happens when you cross the cap, and how long the migration actually takes.

The Formspree math first

Free is 50 submissions/month. One decent landing page burns that in a week.

Personal is $10/mo annual or $15/mo monthly for 200 submissions. But webhooks, autoresponders, and API access are all excluded — those start at Professional, $20/mo annual or $30/mo monthly.

Here's what most comparison posts get wrong: there is no 5,000-submission tier. Professional caps at 2,000, and the next step jumps to Business at 20,000 for $60/mo annual or $90/mo monthly. So if you need 5,000/mo with webhooks, you're paying for a tier built for 20,000.

It also still has no AI in 2026 — no intent classification, no summaries, no lead scoring. You can bolt on Zapier plus an LLM, but that's two more bills and something else to debug at 2 AM.

Netlify Forms is free, but only in one situation

Netlify moved to credit-based plans in April 2026, and the docs are direct about it: "For credit-based plans, Forms are free and unlimited." The old 100 submissions/month cap only applies to legacy plans.

This is the cheapest price in the whole list, so here's the condition that matters:

data-netlify="true" is processed by Netlify's build pipeline. Deploy that same site to Vercel or Cloudflare Pages and nothing reads the attribute — the form simply doesn't exist. So this isn't "free hosting." It's "free if you already picked Netlify as your host."

No AI, just honeypot and reCAPTCHA. Submission history lives in Netlify's backend, and getting it out means a manual CSV download.

<form name="contact" method="POST" data-netlify="true">
  <input name="email" type="email" />
  <textarea name="message"></textarea>
  <button>Send</button>
</form>

Basin owns the Zapier ecosystem

Basin's whole reputation is Zapier / Make / n8n integration — 100+ native apps, and "form → Notion → Slack → CRM" is a turnkey setup. Pricing runs Starter $12.50, Growth $24.17, Pro $40.83, Agency $108.33.

The thing I like most: overages don't cut you off. Traffic spikes, submissions keep arriving, and you're billed on a tiered rate (about $5.25 per 1,000 extra on Pro, dropping to $2 past 100K). That's far nicer than a hard HTTP 402, and for an indie dev who can't forecast launch-week traffic, not losing leads is worth real money.

Two traps:

The free tier deletes your data after 30 days. I missed this on first setup and a client's test inbox emptied itself out a month later. The 100 MB storage and 30-day window are easy to skim past because the signup flow never mentions them.
AI features start at Pro ($40.83/mo). Everything below that is honeypot and captcha, no ML classification. If you're comparing Basin to a $9.90 competitor on price alone, remember you're comparing different products.

I only ran Basin's 14-day trial and didn't go deep on the AI lead agent, so take that part from their docs rather than my testing.

Forminit got renamed, and it drops submissions at the cap

Getform rebranded to Forminit on January 14, 2026 — same team, not an acquisition. Old getform.io endpoints still work, so if you already use Getform, you're already a Forminit customer.

Current tiers: Free $0 (100 submissions, 1 form), Pro $19 (5,000), Business $49 (10,000), Volume $99 (50,000).

It's technically stronger than most people assume. Form Blocks do server-side typed validation — E.164 phone numbers, email format, country codes — instead of untyped key-value pairs. Every plan including Free has an unlimited submission archive with no auto-deletion.

But its limit behavior is the harshest I've seen: when a form hits its cap it pauses, and submissions sent while paused are not stored or queued. They're gone. That's straight from their docs. Basin bills you and keeps going, Netlify has no cap at all, Forminit discards silently. If losing a lead quietly is worse for your business than showing an error page, that matters.

No AI filtering either — server-side validation and honeypot only. Pro at $19 for 5,000 submissions is double SmartForm AI's Pro for the same volume.

FormSubmit is more capable than I gave it credit for

formsubmit.co is the simplest option: no signup, submissions land in your email.

<form action="https://formsubmit.co/your@email.com" method="POST">
  <input name="email" type="email" />
  <textarea name="message"></textarea>
  <button type="submit">Send</button>
</form>

Unlimited forms, unlimited submissions, and — this is the part I got wrong when I first wrote this post — every form comes with reCAPTCHA using machine learning to separate humans from bots. You can turn it off per form with _captcha="false", though their docs advise against it.

It also does native file uploads (10MB per submission), _autoresponse for instant confirmations, and _webhook for delivery. That's a more complete feature set than the "email pipe" reputation suggests.

What's actually missing is the interface, not the features. There's no web dashboard. If you miss an email you can pull the archive through their free API — five times a day — and they retain submissions for 30 days. That last number is the same trap as Basin's free tier, in a place you'd never think to look for it.

The paid tier is a separate product on a separate domain. formsubmit.site sells credits, not subscriptions:

$0.10 per submission to start, dropping to $0.07 at volume
Credits never expire
Spam doesn't cost a credit — only clean submissions count
Email notifications add +1 credit, off by default
Unlimited forms

1,000 submissions/month runs about $80–$100, more than any other service in this list. It's a pay-as-you-go safety valve rather than a primary backend. Its dashboard lives at app.formsubmit.site — so if someone told you FormSubmit "has a dashboard," that's the paid product, not the free one.

SmartForm AI — including the parts I don't like

I said this post is biased, so here are my product's problems.

The free tier has no webhooks and no API keys. That one turns some developers away immediately. Free is a hosted inbox with spam filtering, not a programmable endpoint — if you need to push submissions into a CRM, you're starting at $9.9.

Others: Pro is single-seat, so bringing a teammate into the same workspace means buying Business ($19.9, 10 seats). Audit logs keep 30 days on Pro and 365 on Business, and Free has none. Native file uploads don't exist yet — it's on the roadmap.

Plan	Price	Submissions	Forms	Seats	AI	Webhooks	API keys
Free	$0	200	3	1	Spam only	❌	❌
Pro	$9.9	5,000	Unlimited	1	Spam + intent + summary	✅ + HMAC	✅
Business	$19.9	50,000	Unlimited	10	All of Pro	✅ + custom rules	✅

Past your cap it's a hard refusal: HTTP 402 with error_code: PLAN_QUOTA_EXCEEDED, no auto-upgrade, no overage billing.

The upside is that AI classification is on every paid tier, each submission gets a one-line summary, and webhooks are HMAC-SHA256 signed with 3 retries on failure. Integration is a one-line action change:

<form action="https://api.usesmartform.com/api/v1/f/YOUR_FORM_ID" method="POST">
  <input name="email" type="email" required />
  <input name="name" type="text" required />
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

Formspree's hidden fields (_subject, _gotcha, _next) are understood natively, so migrating doesn't touch your HTML. The webhook payload adds a few fields on top of Formspree's:

{
  "event": "submission.created",
  "submission": {
    "data": { "email": "...", "message": "..." },
    "is_spam": false,
    "spam_confidence": 0.02,
    "intent_label": "high-value",
    "intent_confidence": 0.87,
    "is_high_value": true,
    "ai_summary": "Enterprise customer asking about volume pricing for 50+ seats."
  }
}

The signature header is X-SmartForm-Signature: sha256=<hex>, HMAC-SHA256 over the raw body.

The numbers together

At 5,000 submissions/month with webhooks:

Service	Cheapest tier ≥ 5,000/mo	Notes
Netlify Forms	$0	Netlify-hosted only
SmartForm AI	$9.9	Pro — 5,000, AI included
Forminit	$19	Pro — 5,000, no AI filtering
Basin	$40.83	Pro — 5,000
Formspree	$60	Business — 20,000 (4× headroom)
FormSubmit	~$80–100	Pay-per-credit, 1,000 is already $80+

Per 1,000 submissions that's $1.98 for SmartForm AI Pro, $0.40 for Business, $3.80 for Forminit Pro, and $8.17 for Basin Pro. Formspree's $60 Business tier works out to $3.00 per 1,000 — but it's a 20,000-submission tier, and there is no 5,000-submission equivalent to divide by.

But price tables hide one thing that decides whether a spike costs you money or a lead: what each vendor does at the cap.

Service	Behavior at the limit
SmartForm AI	Refuses submissions, HTTP 402, no auto-upgrade
Basin	Keeps accepting, bills the overage
Netlify Forms	Unlimited — nothing happens
Forminit	Form pauses, submissions discarded, unrecoverable
Formspree	Stops accepting, prompts an upgrade
FormSubmit	Free tier continues; paid credits run out

Migrating takes about 15 minutes

If you decide to switch, it's three steps.

Sign up at usesmartform.com/signup, create a form, copy the 8-character form_id
Change the action URL
Send a test submission and confirm your webhook fires

- <form action="https://formspree.io/f/YOUR_FORMSPREE_ID" method="POST">
+ <form action="https://api.usesmartform.com/api/v1/f/YOUR_FORM_ID" method="POST">

Step 3 is the one people skip, and it's the one that matters. Fire a test submission and confirm the payload actually lands in your CRM before you delete anything on the old side — a 200 response from the form endpoint doesn't mean the webhook delivered. Check the signature header matches what your handler expects, or you'll silently accept forged payloads later.

One caveat up front: SmartForm AI can't bulk-import historical submissions from Formspree. Export to CSV before you decommission if you need the old data, and treat that as the only genuinely irreversible part of the whole move.

That's it — I have a webhook bug to go fix. If you're on the Formspree free tier, go look at this month's submission count. Past 40, start shopping, because going over the limit is usually silent. Happy to argue about any of this in the comments.

Pricing checked against vendor sites in October 2026. If something's drifted, say so and I'll update it.

Adding a Contact Form to a Static Site in 2026: 5 Approaches I Actually Tried (and What I'd Build Differently Today

Alen | SmartForm AI — Wed, 30 Sep 2026 13:00:00 +0000

If you've ever shipped a JAMstack site — Next.js, Astro, Hugo, Gatsby, Eleventy — you've hit the same wall I have: forms don't fit the static model.

No server. No PHP. No Node runtime. Just HTML, CSS, and JavaScript being served from a CDN. And then someone asks: "Can you add a contact form?"

Over the past year I've built contact forms for six different static sites — a personal blog, two client marketing sites, a SaaS landing page, an open-source project page, and a documentation portal. I went through every approach I could find before settling on one. This post is the field report — what worked, what broke, and what I'd do differently today.

A note on bias before we start: I'm the developer behind SmartForm AI, an AI-augmented form backend for static sites. I'll mention it once at the bottom of this post because it directly answers a problem I couldn't solve with the other four approaches. Everything before that is vendor-agnostic. If you only want the comparison, scroll to the matrix and skip the rest.

The problem, stated honestly

A static contact form is deceptively simple on the surface:

<form action="..." method="POST">
  <input name="name" />
  <input name="email" type="email" />
  <textarea name="message"></textarea>
  <button>Send</button>
</form>

But the second you press "deploy", five real questions show up:

Where does the submission go? (Email? Database? Slack?)
How do I stop spam? (CAPTCHA? Honeypot? AI?)
How do I attach files? (Resume uploads, screenshots)
How do I stay notified? (Email? Slack? Webhook to my CRM?)
What happens when traffic spikes? (Someone posts my form on Reddit and 5,000 bots show up in 10 minutes)

Every approach below answers these differently. Let's walk through them.

Approach 1: Platform-native forms (Netlify Forms / Cloudflare Forms)

The path of least resistance. If you're already deploying on Netlify or Cloudflare Pages, you can usually turn on form handling with a single attribute.

<form name="contact" method="POST" data-netlify="true">
  <input name="name" />
  <input name="email" />
  <textarea name="message"></textarea>
  <button>Send</button>
</form>

That's it. Netlify captures submissions, gives you a UI in the dashboard, and even supports webhooks.

What works

Zero configuration.
Spam filtering included (basic honeypot).
Free tier is generous for hobby projects.
Works with any static-site generator that produces HTML.

What breaks

Vendor lock-in. Migrating your static site off Netlify also means rewriting your form backend. I learned it the hard way on a Gatsby project when the build started failing after a Gatsby 4 → 5 upgrade and I had to move to Vercel. Forms broke silently. Submissions just stopped appearing.
Pricing model has changed twice in two years. Netlify switched to credit-based plans in late 2025 — under the new model, Forms submissions are free and unlimited across all tiers, but legacy customers are still being metered on per-site limits. If you're reading tutorials written before 2025, double-check the actual current numbers — most of them are out of date.
No AI. Spam filtering is the standard honeypot plus Cloudflare Turnstile. Residential-proxy bot traffic that fills real-looking fields will sail through.
No lead intelligence. Every submission is just rows in a UI. No classification, no AI summary, no Slack routing based on intent.

Verdict

Best for: tiny personal sites already deployed on Netlify. Worst for: any business site where form data is revenue.

Approach 2: SaaS form backends (Formspree, Web3Forms, Basin, Forminit)

The de-facto option for most static sites today. You point your HTML form at a third-party endpoint and they handle storage, email, spam, and a dashboard.

<form action="https://formspree.io/f/YOUR_FORM_ID" method="POST">
  <input name="name" />
  <input name="email" />
  <textarea name="message"></textarea>
  <button>Send</button>
</form>

Or via fetch for a SPA-style experience:

const res = await fetch('https://formspree.io/f/YOUR_FORM_ID', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ name, email, message })
});

What works

Portable. Works on Vercel, Netlify, Cloudflare, GitHub Pages, raw S3, anywhere.
Mature spam filtering. Most services now offer reCAPTCHA, honeypot, or ML-based filtering (Formspree's "Formshield", Basin's reCAPTCHA + content filter) out of the box.
Webhooks and Zapier-style integrations for routing to Slack, CRMs, etc. This is the killer feature for small teams.
Decent free tiers (Formspree 50/mo, Web3Forms 250/mo, Basin 50/mo).

What breaks

Free-tier cliff, vendor by vendor. Formspree jumps from $0 (50 subs) to $10/month (200 subs) on the Personal plan, then $20/month (2,000) on Professional. Web3Forms' free tier is more generous at 250/mo but its paid plans sit at a similar price-per-submission ratio. Basin is the priciest of the three: Starter is $12.50/mo for 250 submissions and Pro is $40.83/mo for 5,000 — roughly 4× more expensive than Formspree Pro for the same volume.
File uploads vary wildly. Formspree includes 1GB / 5GB / 10GB on its paid tiers (none on Free). Web3Forms and Basin include file storage on paid tiers only. Getform rebranded to Forminit in January 2026 and is the only one of these that bundles 100MB of file storage on the Free tier.
No lead intelligence. Every submission lands in your inbox or dashboard as raw rows. If you want to know "which of these 80 messages are actually sales inquiries worth following up today?", you read them manually.
Rate limits and burst behavior differ across vendors and aren't always published. A friend hit a Web3Forms wall during a Product Hunt launch with no published threshold to debug against. Plan for a quiet week before any launch.

Verdict

Best for: most personal sites, side projects, low-volume marketing pages. Worst for: anything where form content needs classification or where free-tier → paid is too steep.

Approach 3: Serverless functions (Cloudflare Workers, Vercel Functions, AWS Lambda)

The "real engineer" answer. Spin up a serverless function, accept the submission, store it, email it. Full control.

A minimal Cloudflare Worker:

export default {
  async fetch(request, env) {
    if (request.method !== 'POST') return new Response('Method not allowed', { status: 405 });

    const data = await request.json();

    // Honeypot check
    if (data._gotcha) return new Response('ok', { status: 200 });

    // Send email via Mailgun
    await fetch('https://api.mailgun.net/v3/yourdomain.com/messages', {
      method: 'POST',
      headers: {
        Authorization: 'Basic ' + btoa('api:' + env.MAILGUN_KEY),
        'Content-Type': 'application/x-www-form-urlencoded'
      },
      body: new URLSearchParams({
        from: 'noreply@yourdomain.com',
        to: 'you@yourdomain.com',
        subject: `New contact from ${data.name}`,
        text: data.message
      })
    });

    return new Response(JSON.stringify({ ok: true }), {
      headers: { 'Content-Type': 'application/json' }
    });
  }
};

What works

Total control. Your logic, your dependencies, your database.
Cheap at scale. Cloudflare Workers' free tier is 100k requests/day.
No vendor lock-in. The function is yours to deploy anywhere.
Latency. Edge functions run geographically close to the user.

What breaks (and this is the long list)

I built this exact setup for a client's marketing site. Here's what I learned:

Spam filtering is now your problem. Honeypots catch the dumbest bots, but the moment you deploy on a real domain you get targeted bots that read your source code, fill real-looking fields, and bypass honeypots. You'll be reading raw POST bodies at 2am trying to figure out patterns.
Rate limiting means wiring up KV / Redis. Cloudflare KV works but its eventual-consistency model means a bot can hit your form 50 times in the first second before the limit kicks in.
Email deliverability is a full-time job. You need SPF, DKIM, DMARC records, a verified sending domain, and warm-up time. I shipped a form on a Friday and spent the weekend debugging why emails went straight to spam on Gmail.
File uploads are painful. Multipart parsing in Workers is doable but not pleasant. You'll write a custom parser or pull in a 100KB dependency.
No dashboard for clients. If the site owner isn't technical, you'll be exporting CSVs and emailing them every Monday.
No analytics. Want to know conversion rate from page-view → submission? Build your own analytics pipeline.
Maintenance is forever. Six months in I was still patching edge cases: bot signatures, IP reputation lookups, CSRF tokens, file size limits, MIME type sniffing, GDPR data-export endpoints.

I gave up on this approach after about three months. The function itself was 80 lines. The supporting infrastructure — spam, email, dashboard, analytics, retention — was easily 2,000 lines and growing.

Verdict

Best for: engineers with very specific needs who enjoy maintaining infrastructure. Worst for: anyone who wants to spend their time on the actual product, not form plumbing.

Approach 4: Pay-per-submission credit packs (FormSubmit)

A middle ground. You host no code. You point a form at FormSubmit and the submission lands in your inbox (and optionally a webhook). No subscription — you buy a one-time credit pack and credits never expire.

<form action="https://formsubmit.co/your@email.com" method="POST">
  <input name="name" />
  <input name="email" />
  <textarea name="message"></textarea>
  <button>Send</button>
</form>

FormSubmit's pricing is unusually honest for this category: 100 credits = 100 submissions = $10, scaling down to $0.07/submission at the 2,500-credit pack. Credits never expire, no monthly fee, no tier you have to upgrade into.

What works

Almost zero setup.
Spam doesn't consume credits — only clean submissions are billed against your balance.
No subscription trap. A weekend project can buy 100 credits once and use them for years.
Submissions land directly in your inbox, and webhooks are supported out of the box.

What breaks

No persistence. Once it's in your inbox, it's gone. No dashboard, no search, no analytics.
Per-submission cost adds up at scale. At $0.07/submission, 5,000 clean submissions/month = $350/month — Formspree Pro does the same volume for $20/month. FormSubmit is built for low-volume use, not lead-gen SaaS.
No lead intelligence. No AI classification, no Slack routing by intent.
CAPTCHA is per-form opt-in. You can disable reCAPTCHA on individual forms (<input type="hidden" name="_captcha" value="false">), but doing so hands you back to your own spam problem.

Verdict

Best for: hobby projects and side sites where you want to pay once and forget about it. Worst for: anything resembling a business with meaningful lead volume.

Approach 5: An AI-augmented pipeline (the one I ended up shipping)

After all that, here's the architecture I kept wishing existed:

Accept form submission via a simple POST /api/v1/f/{form_id}.
Run it through an LLM that returns: { is_spam, spam_confidence, intent, intent_confidence, summary, is_high_value }.
If spam → silently drop, don't email, don't count against quota.
If not spam → email me a digest with the AI summary prepended.
Store everything in a database with search, filtering, and CSV export.
Webhook to Slack/CRM with the classification attached.
Rate-limit at the edge (Redis sliding window).
Free tier for hobbyists, paid tier for teams.

This is essentially what I ended up building. But before you skip to the bottom and click the link — let me show you the AI layer because it's worth understanding even if you don't use my tool.

A realistic AI classification prompt

SPAM_PROMPT = """You are a professional spam-detection specialist.
Analyze the form submission below and decide whether it is spam or legitimate.

Decision criteria:
- Spam ads: product/service promotion, mass-sent links, SEO-bait content
- Malicious messages: phishing links, scams, malware promotion
- Legitimate messages: real customer inquiries, technical support requests, feedback

Only analyze the `message` field."""

INTENT_PROMPT = """You are a professional form-content analyst.
Identify the user's true intent.

Intent types:
- sales: pricing, quotes, purchase intent
- support: technical help requests
- general: greetings, generic inquiries
- feedback: comments, suggestions, complaints
- other: anything else

High-value sales signals:
- Clear purchase intent
- Bulk / custom pricing questions
- Specific quantities or budgets
- Enterprise / business inquiry

Generate a concise English summary (under 50 words)."""

I used gpt-4o-mini for this. Cost per submission: roughly $0.0001. Even at 10,000 submissions/month, that's about a dollar.

Why this matters in practice

A typical week of form submissions on a B2B SaaS landing page might look like:

Raw submission	Without AI	With AI
"Hi, I'd like a quote for 50 seats of your enterprise plan."	You read it Monday morning, reply Tuesday.	Pings your Slack `#sales` channel with `intent=sales, is_high_value=true`. Rep replies same day.
"Buy cheap watches rolex replica www.example.com"	You mark it as spam.	Auto-classified, never reaches your inbox.
"Your docs are great, but the API auth section is confusing."	You bookmark it, forget to act.	Pings `#docs` channel with `intent=feedback`. PM reads it Friday, files an issue.

That's the difference between a contact form and a lead funnel.

The honest comparison

Here's the matrix I wish someone had handed me before I spent three weekends on this:

Approach	Setup time	Free tier	File uploads	AI features	Data ownership	Lock-in
Platform-native (Netlify Forms)	2 min	Unlimited under new credit-based plans (legacy: 100/mo)	Yes	No	Vendor's DB	High
SaaS (Formspree / Web3Forms / Basin / Forminit)	5 min	50–250 subs/mo	Paid tiers (Forminit includes 100MB on Free)	No	Vendor's DB	Medium
Serverless function	1–2 days	100k req/day (CF)	DIY	DIY	Yours	None
Form-to-email relay (FormSubmit)	2 min	Pay-per-submission credits ($0.07–$0.10/clean submission, never expire)	No	No	Your inbox	Low
AI-augmented SaaS	5 min	200 subs/mo (free)	No (use a dedicated service)	Yes	Yours (CSV export)	Low

A few things to read between the lines:

Setup time is misleading for DIY. "1–2 days" is the function. The infrastructure around it (spam, email, dashboard, analytics) is weeks.
Data ownership matters more than most people think. Vendor shutdowns happen. Price changes happen. If your form is a business-critical lead source, make sure you can export everything as CSV.
AI features aren't a nice-to-have if you get more than ~50 submissions/week. Manual triage stops scaling around that point.

My final solution (and the honest disclosure)

After going through all four of those approaches for actual client work, I ended up building a tool that combines them: an AI-augmented form backend that you embed with a single <form> tag or a single fetch() call.

I'm the developer behind SmartForm AI. I built it because I kept needing exactly this stack for my own projects and didn't want to wire it up from scratch for the fifth time.

What it does that the others don't (or don't do well):

AI spam filter + intent classification + lead scoring out of the box, using a prompt pipeline similar to what I showed above. Legitimate sales inquiries get a Slack ping with is_high_value: true. Spam never reaches your inbox — and spam doesn't count against your quota, so a bot storm doesn't burn through your free tier.
Free tier is 200 submissions/month with AI spam filtering included, no credit card. SmartForm AI's free tier pairs the AI layer with a generous submission cap — most form-backend free tiers either cap you at 50 submissions (Formspree, Basin) or strip AI out of the free tier entirely.
Pricing stays simple. Pro is $9.9/mo for 5,000 submissions; Business is $19.9/mo for 50,000. No "AI filtering $9/mo add-on" bolted on, no tier that excludes webhooks, no surprise overage bills.
Webhooks fire with the AI classification attached so you can route sales inquiries to your CRM, feedback to Linear, and ignore spam. Pro tier adds HMAC signing; Business adds retry + dead-letter queue.
Formspree-compatible API — POST /api/v1/f/{form_id} with JSON or form-data, so the migration from a Formspree-backed site is a single URL change.

A few honest caveats so you can decide if it fits: SmartForm AI doesn't currently support file uploads natively (if you need resume or screenshot attachments, you'll still wire up a dedicated upload service like Uploadcare or S3 presigned URLs). The Free tier caps at 200 submissions/month without an automatic upgrade — submissions above that get rejected with HTTP 402 rather than silently upgraded. If either of those is a deal-breaker, Formspree or Forminit will serve you better.

I won't pretend it's the only tool in this space — Formspree, Web3Forms, Basin, and the rest are solid for the 80% case. SmartForm AI is what I reach for when I want the AI layer and don't want to maintain the infrastructure myself.

Try it if it fits your use case, ignore it if it doesn't. The matrix above is the only thing I'd actually want you to take away from this post.

What's next

If you're starting from scratch today, my recommendation in order:

Personal site, < 100 subs/month → Web3Forms (250/mo free with custom redirect) or Forminit's free tier (100/mo with 100MB file uploads). Both let you avoid any vendor lock-in.
Already on Netlify for everything else → Netlify Forms. Free and unlimited under the current credit-based plan.
Low-volume side project where you'll send < 1,000 forms over its lifetime → FormSubmit credit packs. Buy 100 credits once for $10 and forget about subscriptions — they never expire.
Client marketing site, < 1,000 subs/month → Formspree Personal ($10/mo, 200 subs) or Pro ($20/mo, 2,000 subs). Mature, boring, works.
Business-critical lead source, > 500 subs/month → AI-augmented SaaS or a serverless function with an LLM in the loop. The manual-triage tax will eat your week otherwise.
Compliance-sensitive (healthcare, finance, EU) → Self-hosted serverless function with your own database. Data ownership is non-negotiable.

Have I missed an approach? I'd love to hear what you're using — especially if you've found something I haven't tried. Drop it in the comments.

If this saved you some weekend time, a ❤️ or a follow helps others find it. I'm planning a follow-up on the spam-filtering prompt specifically — let me know in the comments if that's useful.

DEV Community: Alen | SmartForm AI

How to Handle Form Submissions in Node.js and Express (Without Writing Spam Logic)

What an express form backend actually costs you

Option 1: Node.js form submission via POST from your Express route

Option 2: A nodejs contact form where the browser POSTs directly

Option 3: Receive processed submissions via webhook (express webhook form handler)

Which pattern should you pick?

The part you don't have to write

I Added a Contact Form to an Astro Site Without a Backend

Why Astro forms trip people up

What I tried (and why I backed out)

The form

Gotcha #1: the Accept header

Gotcha #2: the honeypot needs three attributes

Spam: layer it, don't pick one

When I'd use Astro Actions instead

Verdict

Form Backend Pricing in 2026: What Actually Costs You Money

Why re-verify pricing at all?

TL;DR by volume

Real monthly cost comparison

The Netlify asterisk is doing a lot of work

What each service actually charges

SmartForm AI

Formspree

Netlify Forms

Basin

Forminit (formerly Getform)

Cost per 1,000 submissions

On FormSubmit's paid model

What happens when you hit the limit

Recommendations by scenario

The part pricing pages never mention

FAQ

5 Formspree Alternatives Worth Switching to in 2026 (An Honest Comparison)

The Formspree math first

Netlify Forms is free, but only in one situation

Basin owns the Zapier ecosystem

Forminit got renamed, and it drops submissions at the cap

FormSubmit is more capable than I gave it credit for

SmartForm AI — including the parts I don't like

The numbers together

Migrating takes about 15 minutes

Adding a Contact Form to a Static Site in 2026: 5 Approaches I Actually Tried (and What I'd Build Differently Today

The problem, stated honestly

Approach 1: Platform-native forms (Netlify Forms / Cloudflare Forms)

What works

What breaks

Verdict

Approach 2: SaaS form backends (Formspree, Web3Forms, Basin, Forminit)

What works

What breaks

Verdict

Approach 3: Serverless functions (Cloudflare Workers, Vercel Functions, AWS Lambda)

What works

What breaks (and this is the long list)

Verdict

Approach 4: Pay-per-submission credit packs (FormSubmit)

What works

What breaks

Verdict

Approach 5: An AI-augmented pipeline (the one I ended up shipping)

A realistic AI classification prompt

Why this matters in practice

The honest comparison

My final solution (and the honest disclosure)

What's next

Gotcha #1: the `Accept` header