Forms without a back-end

Heapform is a form backend for HTML and JavaScript forms. You point your form at a Heapform endpoint, and Heapform stores each submission, validates fields, filters spam, sends email notifications, and can forward data to your own webhooks. You keep full control of the form's markup and design.

No. Your form posts directly to an endpoint like https://forms.heapform.com/f/YOUR_FORM_SLUG, so it works on static sites and on hosts like Vercel, Netlify, Cloudflare Pages, and GitHub Pages without any backend code.

Any site that can send an HTTP POST. Plain HTML forms work with no JavaScript. Fetch-based forms can send JSON, and React and Next.js apps can use the @heapform/react SDK. Endpoints accept URL-encoded, multipart, and JSON bodies.

Yes. The Hobby plan is free and includes 3 forms and 100 submissions per month, with no credit card required. Paid plans add more forms and submissions, file uploads, team members, and webhooks.

Spam protection is on by default for every form. Heapform checks a honeypot field and other signals such as link-heavy messages, scripted clients, and bursts from one IP address. You can also enable Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA. Flagged submissions are kept and marked as spam, never sent to webhooks, and don't count toward your monthly quota.

Yes, on the Starter plan and above. Use a multipart form with file inputs; uploads are stored for you and linked from each submission, up to 100 MB per submission on the largest plan.

Yes, with webhooks on the Pro plan and above. Heapform sends a JSON payload for each new submission to up to 5 URLs per form. Spam is never forwarded. There are no built-in Slack or CRM integrations yet, so webhooks are the integration point.

Yes. Configure rules per field in the dashboard (required, number, URL, phone number, minimum and maximum length, contains, and does not contain). Invalid submissions get a 422 response with a structured error for each field, which you can show in your UI.

Yes. Export any form's submissions as CSV or JSON from the dashboard. Submissions are kept according to each form's archive setting, from 30 days up to forever depending on your plan.

Yes. Heapform publishes an llms.txt file with the endpoint format, request and response examples, validation rules, and webhook payloads, so assistants like Claude, Cursor, or Copilot can wire up a form correctly. You still create the form in the dashboard and paste its endpoint URL.