I thought receiving HTML form submissions was the easy part. Spam proved me wrong.

Like many developers, I assumed a contact form was a weekend project.

<form action="..." method="POST">

Point it to an endpoint, save the data, send an email... done.

Except it wasn't.

Within hours of exposing the endpoint publicly, the form started receiving:

• Bot submissions
• Disposable email addresses
• Random promotional messages
• Empty payloads
• Thousands of repeated requests

The surprising part wasn't that bots existed.

It was how quickly they found a brand-new endpoint.

That made me rethink what a "simple form backend" actually needs.

Instead of just accepting POST requests, I ended up adding things like:

• Cloudflare Turnstile verification
• Honeypot protection
• Disposable email detection
• Rate limiting
• Spam scoring
• Signed webhooks
• Google Sheets sync

The biggest lesson was this:

Receiving submissions is easy. Receiving clean submissions is the hard part.

I also realized many developers don't actually want another backend to maintain. They just want their HTML, React, Next.js or Astro form to work without spinning up an API.

That's why I built Formz.

👉 https://useformz.com

It's a lightweight form backend that lets you receive form submissions, filter spam, sync with Google Sheets, and trigger webhooks without building your own backend.

I'm still improving it, so I'd genuinely love your feedback.

What's the worst spam attack you've seen on a contact form?

Did you build your own solution, or are you using something like Formspree, Web3Forms, Getform, or another service?