I thought receiving HTML form submissions was the easy part. Spam proved me wrong.

Ritesh Gupta — Fri, 17 Jul 2026 10:18:10 +0000

Like many developers, I assumed a contact form was a weekend project.

<form action="..." method="POST">

Point it to an endpoint, save the data, send an email... done.

Except it wasn't.

Within hours of exposing the endpoint publicly, the form started receiving:

Bot submissions
Disposable email addresses
Random promotional messages
Empty payloads
Thousands of repeated requests

The surprising part wasn't that bots existed.

It was how quickly they found a brand-new endpoint.

That made me rethink what a "simple form backend" actually needs.

Instead of just accepting POST requests, I ended up adding things like:

Cloudflare Turnstile verification
Honeypot protection
Disposable email detection
Rate limiting
Spam scoring
Signed webhooks
Google Sheets sync

The biggest lesson was this:

Receiving submissions is easy. Receiving clean submissions is the hard part.

I also realized many developers don't actually want another backend to maintain. They just want their HTML, React, Next.js or Astro form to work without spinning up an API.

That's why I built Formz.

👉 https://useformz.com

It's a lightweight form backend that lets you receive form submissions, filter spam, sync with Google Sheets, and trigger webhooks without building your own backend.

I'm still improving it, so I'd genuinely love your feedback.

What's the worst spam attack you've seen on a contact form?

Did you build your own solution, or are you using something like Formspree, Web3Forms, Getform, or another service?

DEV Community: Ritesh Gupta

I thought receiving HTML form submissions was the easy part. Spam proved me wrong.