Send an HTML form to email without PHP

Change the form's action from your PHP script to a form backend's URL, keep the field names, and delete the script. The backend does what mail() did, plus the parts it never did well: spam filtering, storage and mail that doesn't land in spam. It works on static hosts where PHP can't run at all.

What's different here

Most PHP contact forms are the same twenty lines, copied from a tutorial years ago. They read $_POST, build a string, call mail(), and redirect. Here's a typical one:

<?php
$name = $_POST["name"];
$email = $_POST["email"];
$phone = $_POST["phone"];
$message = $_POST["message"];

$to = "hello@example.com";
$subject = "Website enquiry from $name";
$body = "Name: $name\nEmail: $email\nPhone: $phone\n\n$message";
$headers = "From: $email\r\nReply-To: $email";

if (mail($to, $subject, $body, $headers)) {
  header("Location: /thanks.html");
} else {
  echo "Sorry, something went wrong.";
}

It looks harmless, and it worked when it was written. Today it breaks in four ways, and only the first is obvious:

You could fix each one: validate every value, send through an SMTP provider with a library such as PHPMailer, set up SPF and DKIM for your domain, add a honeypot and rate limit, and log to a database. That's a reasonable project if you already run PHP. If you'd rather not, move the work to a form backend.

Move the form off PHP

Keep the field names exactly as they are. Only the action changes, plus two hidden inputs:

<form action="/contact.php" method="post">
  <input name="name" required />
  <input name="email" type="email" required />
  <input name="phone" type="tel" />
  <textarea name="message" required></textarea>
  <button>Send</button>
</form>

<form action="https://ikiform.com/f/frm_xxxxxxxxxxxxxxxx" method="post">
  <input name="name" required />
  <input name="email" type="email" required />
  <input name="phone" type="tel" />
  <textarea name="message" required></textarea>
  <input type="hidden" name="_redirect" value="https://example.com/thanks.html" />
  <input name="_gotcha" type="text" tabindex="-1" autocomplete="off" hidden />
  <button>Send</button>
</form>

Then map each thing the script did to where it lives now:

• Add your domain under Allowed domains. _redirect only works for an https: URL on one of those domains.
• Delete contact.php from the server once the new form works. A forgotten script is still an open mail relay for bots that remember the URL.
• If you moved to a static host, the old /contact.php URL no longer exists. Bots that post straight to it get a 404, which is fine.

Check it works

1. Under the form's Allowed domains, add your site's domain, plus localhost while you develop. Leave it empty to accept posts from anywhere.
2. Submit the form on your live page. You land on your old thanks.html.
3. Open Submissions in the dashboard. The new submission is there with every field you sent.
4. Open the email. It comes from Ikiform, not from the visitor's address, and isn't in spam. Add the sender to your contacts so later ones aren't either.
5. Press Reply. The visitor's address is in the To line.
6. Post with the honeypot filled in, _gotcha=bot. It still gets a success answer, but the submission is stored as spam and sends no email or webhook.

Gotchas

• Old form names with brackets. PHP forms often use names like contact[email]. Ikiform stores them as they are, but the reply-to only comes from a field named email or a few close variants. Rename the field, or add _replyto.
• The subject can't include the name. The script's subject line had the visitor's name in it. The notification subject is fixed, and _subject is passed to webhooks and the API without changing the email.
• Character encoding. mail() scripts often mangled accents because they never set a charset. Ikiform's email is UTF-8, so names in any script arrive intact.
• Multiple addresses in $to. A comma list in the script becomes separate recipients in the dashboard. Outside addresses confirm by link before they get anything. See multiple recipients.

If something goes wrong

Questions