A Form Backendfor Static Sites
Your HTML form has nowhere to send its data. Paste one endpoint URL into the action attribute and it works — every submission emailed to you and kept in your dashboard. No JavaScript, no server, no API key.
One Attribute. That's the Change.
Whether you wrote the page by hand or generated it with AI, the form is already there. It just has nowhere to post. Give it an address.
<form action="https://api.dplooy.com/f/studio-contact"method="POST"><input name="name" required><input name="email" type="email"><textarea name="message"></textarea><button>Send</button></form>
No <script> tag. No API key. No hidden fields required. The highlighted line is the only thing you add.
await fetch('https://api.dplooy.com/f/studio-contact', {method: 'POST',headers: { 'Accept': 'application/json' },body: new URLSearchParams(new FormData(form)),})
Same URL. The highlighted Accept header is what swaps the confirmation screen for a JSON response, so the visitor never leaves the page. A form-encoded body avoids a CORS preflight.
Works With No Backend at All
Static HTML has no server to receive a POST. The endpoint is that server, hosted for you — so a plain HTML page gets a working contact form without you deploying anything.
Your Field Names, Your Choice
Whatever you name your inputs is what shows up in your submissions and your CSV columns. There is no fixed schema to match and no fields you are forced to include.
Two Optional Extras
Add _form to label which form a submission came from, and a hidden _gotcha field to catch spam bots. Both are one line, and both are optional.
Get the URL Before You Build
Create an endpoint before you have a site and the URL is real immediately — so you can hand it straight to an AI prompt or paste it into a draft. Assign it to a project when you deploy.
Working Form in Under a Minute
No server to configure, no database to create, no deployment step. Name it, paste it, read it.
Create an Endpoint
Give it a name like "Contact" and you get a URL at api.dplooy.com/f/your-form.
Paste It Into Your Form
Drop the URL into your form's action attribute. On the Site Builder, just pick it from a dropdown.
Read Your Submissions
Every submission lands in your dashboard, searchable and exportable, with spam already filtered out.
One enquiry, from both sides
Follow a single contact form — from Maya pasting one URL to the client who writes to her at midnight.
Maya, the owner
Her visitor
Maya's beautiful site has a dead form
Maya's portfolio was generated by AI and looks sharp — but the contact form goes nowhere. Static hosting can't receive a submission, and every form service she found wanted an account, a script, and a monthly fee.
She creates a form address
In her dashboard she clicks Features in the top bar, chooses Forms, then New endpoint. She picks which website it belongs to (or No project yet if the site isn't up), names it “Contact”, and confirms where messages should be emailed — her own address is already filled in. She clicks Create endpoint and gets her own address instantly.
She points her form at it
She clicks the </> button, copies the ready-made form and pastes it into her page — or clicks the robot button and lets ChatGPT write the form for her. Building in Site Builder instead? She'd just pick the form from the Contact Form block's dropdown — nothing to paste. Then she drops the page on the dashboard's drop zone and clicks Assign.
A prospective client writes to her
Someone lands on Maya's site at midnight, likes the work, and fills in the contact form: name, email, project details. They hit Send.
They get a checkmark, not a wall of code
Instead of raw JSON or a stranger's branded page, they see a clean "Message sent" screen for two seconds — then the browser returns them to Maya's site automatically. A hidden field they never saw just filtered out the bots.
Maya wakes up to the lead in her inbox
The message is sitting in her email, fields laid out and ready to read — she hits reply and it goes straight back to the client, because the form asked for their address. The same message is in Features → Forms with an unread count on the form's name. She types a name or email into the search box to find any message she's ever received, and clicks Export CSV to take the whole lot into a spreadsheet.
Nothing breaks as she grows
She adds a quote form on another page with its own New endpoint. Later she redesigns the site — the address never changes, so the live form keeps working. Only her own website can post to it, so scrapers get nowhere. Going on holiday? Pause stops new messages without deleting a thing.
They Never Land on a Broken Page
A plain form submit is a browser navigation — the visitor leaves your page for a moment. Most form services answer with raw JSON or a branded page. Yours gets a checkmark and a trip straight back.
They hit Send
The browser posts your form to the endpoint. Nothing is required on your page for this to work — no script, no listener.
A quiet confirmation
A checkmark and one line of text. No adverts, no logo competing for attention, no navigation away from your brand.
Back to your site
After about two seconds the browser returns them to the page they came from — using plain HTML, so it works with JavaScript disabled.
There is no redirect field to abuse
Visitors are only ever returned to the page they came from or your own site — never to an address supplied in a form field. That means the endpoint cannot be used to bounce someone to a phishing page, which is a common weakness in form services that accept a redirect parameter.
Plain HTML or Fetch — Both Work
The same endpoint serves both. Pick whichever suits the site you are building.
Plain HTML Form
One attribute, nothing else
Fetch / AJAX
For developers who want control
Start with the plain form. Switch to fetch later without changing your endpoint.
Everything a Form Backend Should Do
Collecting the submission is the easy part. What you can do with it afterwards is what matters.
Email Notifications
Every submission is emailed to you as it arrives, fields laid out and ready to read. Reply and it goes straight to the visitor. Set the address per endpoint, or switch it off.
Submissions Inbox
Every submission in one place, grouped by endpoint, with a count of what has arrived since you last looked so nothing sits unnoticed.
Search Across Fields
Find a submission by any value inside it — an email address, a name, a phrase from a message. Essential when someone asks you to delete their data.
CSV Export
Export any endpoint to a spreadsheet, safely escaped so a crafted submission can't run as a formula when you open it in Excel.
Spam Filtering
A honeypot field bots fill and humans never see, plus per-IP rate limiting. Flagged submissions are kept aside and never count against your quota.
Locked to Your Site
By default an endpoint only accepts submissions from your own site, so nobody else can point their form at it. One toggle lifts that if you need it.
No IP Addresses Stored
Visitor IPs are used for rate limiting in memory and then discarded. The only data kept is what your visitor typed, because you asked for it.
Perfect For
Portfolio Sites
Let people reach you without publishing your email address for scrapers to harvest.
AI-Generated Pages
Your generated landing page already has a form. Give the AI the endpoint URL and it works on the first deploy.
Local Business Sites
Quote requests, booking enquiries, and callback forms — collected and exportable without a CRM.
Site Builder Pages
Drop in a form block, choose your endpoint from the dropdown, publish. Nothing to paste at all.
What You Get on Each Plan
Form endpoints are included with Plus and Pro — no separate subscription, no per-submission pricing.
Plus
$4.99/moPro
$12.99/moFrequently Asked Questions
What is a form backend?
A static website has no server, so an HTML form has nowhere to send its data. A form backend is that missing piece: a URL you put in your form's action attribute. When someone submits, the data is posted to that URL, stored, and shown back to you. No server, no database, and no backend code of your own.
Do I need to add JavaScript to my page?
No. A plain HTML form tag is the primary path and it works with nothing added but the endpoint URL. There is no script tag, no fetch call, and no hidden fields you are required to include. A fetch-based path exists as an option for developers, but it is never necessary.
What happens to the visitor after they hit Send?
A plain form submit is a browser navigation, so the visitor briefly leaves your page. Dplooy answers with a small confirmation screen — a checkmark and one line of text — and the browser returns them to the page they came from after about two seconds. It works with JavaScript disabled, because it uses a plain HTML meta refresh rather than a script.
Can I use the endpoint on a site hosted somewhere else?
By default an endpoint only accepts submissions from the site of the Dplooy project it belongs to — that is what keeps other people from pointing their forms at your endpoint. If you host your marketing site on Dplooy and your app somewhere else, each endpoint has an 'allow any origin' toggle that lifts the restriction.
How is spam handled?
Three layers. An optional honeypot field that real visitors never see and bots reliably fill in, a per-IP rate limit on the endpoint, and a monthly cap. Anything flagged as spam is kept separate so you can spot-check for false positives, and it never counts against your monthly submission allowance.
Do you store my visitors' IP addresses?
No. The IP is read from the request for rate limiting, held in memory, and discarded. It is never written to storage, never returned by the API, and never included in a CSV export. The only personal data stored is what your visitor typed into your form because you asked for it.
Do I get an email when someone submits the form?
Yes. Every accepted submission is emailed to you as it arrives, with the field values laid out in the message — and when the form captured the visitor's email address, hitting reply writes straight back to them. You pick the destination address when you create the endpoint (your account email is filled in for you) and can change it, or switch notifications off, per endpoint at any time. Anything caught as spam never triggers an email. Every submission is still kept in the dashboard inbox, searchable and exportable.
Can I get my submissions out?
Yes. Every endpoint exports to CSV, and the submissions list is searchable across field values so you can find a specific person quickly. Your data is never locked in.
Which plans include form endpoints?
Plus ($4.99/mo) and Pro ($12.99/mo). Plus includes 10 endpoints and 500 submissions per month with 30-day retention. Pro includes 50 endpoints and 5,000 submissions per month with 12-month retention. Free plan users can upgrade at any time.
Does it work with the Site Builder?
Yes. Drop a form block onto a page and pick your endpoint from a dropdown — there is nothing to paste. The published page posts to it directly, with the spam honeypot included automatically.
Give Your Form Somewhere to Go
One URL in your form action and your static site can collect messages. Spam filtered, searchable, exportable, and hosted alongside your site.