Forms
Multi-step forms that are validated on the server, not in the design.
Contact, quote, appointment booking, survey, newsletter signup. You define what’s asked, in what order, what’s required and where it goes; the theme decides how it looks. And even if a design skips a rule, the server enforces it anyway.
- Pages
- Posts
- Media
- Store
- Forms
- SEO
Pages
Home
Page blocks
- Hero
- Featured
- Testimonials
- Form
- FAQ
What you get
About twenty field types that work well, rather than sixty that half do
Text, email, phone, date, dropdown, checkboxes, file, address, rating, consent, repeater, calculated field and payment field, among others. The catalog is code, typed for the theme, and grows with each release.
-
Several steps, without losing anyone
A fifteen-field quote doesn’t get filled in one sitting. The visitor leaves it halfway, comes back through the same link and finishes. And you see which step people drop off at, which is what really tells you which question is one too many.
-
Conditional logic
Check “I have a storefront” and the address appears; leave it unchecked and it’s never asked. All-or-any rules, jumps between steps, and a field that isn’t shown isn’t required. The browser and the server evaluate the same rule.
-
From the calculation to the payment: The payment gateways
Square feet times price plus installation: the total shows while they type. And if you take a deposit, the server works out the amount from the validated values and your notification arrives when the gateway confirms, not before.
-
Layered antispam, without getting in the way: How we protect your site
A honeypot field, a minimum fill time, a per-IP limit and word and address lists. Your visitor sees none of them, and the bot gets a thank-you like everyone else: telling it what gave it away is teaching it to do better.
-
Private attachments
A résumé or a floor plan doesn’t go to your image library, which is public and opens for anyone with the link. It goes to a private folder, and from the panel you download it with a link that expires in ten minutes.
-
Submissions you can work with
You mark one as read, leave a note for whoever handles it, resend the notification to the salesperson who missed it, and take the whole month to CSV. Exporting or deleting submissions is logged: it’s other people’s data.
Where the submission goes
Your site doesn’t receive the submission. The core does, and checks it there.
Your site draws the form; what stores the data is the platform, against the schema you saved. That’s why a rule doesn’t get lost when the design changes, and a broken theme doesn’t quietly leave you without data: it fails and you find out.
-
A made-up field is dropped
Only what’s declared in your form is stored. Anything extra that arrives never reaches the database, whoever sent it.
-
A required field that isn’t drawn doesn’t validate
If the design leaves a required field out, the submission fails. It’s the same mistake as removing it, and it’s treated just as badly.
-
Only from your domains
A submission fired from another website, or aimed at another account’s form, is rejected before anything else is even read.
How it arrives
From the send button to your inbox
Four steps, and the antispam looks first so that what you review comes from people.
-
They fill it in and send
With JavaScript the page doesn’t reload and the error appears next to the field. Without JavaScript it still submits and the answer is drawn on the page: nobody is left out.
POST /submissions
-
The antispam looks first
Honeypot field, minimum fill time, a limit per IP and hour, and word and address lists. What gets caught is flagged as spam and kept: what’s deleted can’t be reviewed.
4 layers · flagged, not deleted
-
The server validates against your schema
It applies your conditional logic before requiring anything, fills the hidden fields with what it knows and recalculates the totals. If something fails, it returns one error per field, in plain English.
page · referrer · UTM
-
It lands in your panel and your inbox
With its status, its notes and its private attachments. The email goes out through a queue with retries and replies to the address the visitor left.
Reply-To: whoever wrote you
And if they leave it halfway, what they had is saved and they come back through the same link to finish. That partial doesn’t count toward your limit, doesn’t notify you twice and, once completed, replaces the earlier one instead of duplicating it. That’s where drop-off per step comes from: the question people walk away at.
Browser validation is a convenience. The one that counts is on the server.
On your visitor’s screen
It’s part of your site, not another service’s form dropped inside it
It loads with the page, uses your typeface and your colors, and sends nobody off to another domain to fill anything in. What changes with the design is how it looks; what never changes is what’s asked and where it goes.
- Without JavaScript it submits and works; with JavaScript it doesn’t reload and moves focus to the first error
- Every error sits next to its field and is announced to screen readers, never by color alone
- Totals and conditional logic resolve live with the same function the server uses
- It opens and closes by date, with a submission limit and your own message once it’s closed
- The consent field carries your wording, and the IP is only stored if you decide so
AI design
Ask for the fields in two columns. You can’t ask for them to be sent elsewhere.
“Fields in two columns, an orange button and the error in red underneath”: that’s design, and the AI rewrites the component for each field type. Removing a field, dropping a required flag, touching the consent or the antispam aren’t options that exist, however politely you ask.
- The component loops over your form’s fields; writing them by hand is a validation failure
- A label per field, an associated error and visible focus are in the contract the model receives
- Every change is a version: see it in the preview, publish it or go back to how it was
- If the change fails validation, it isn’t applied and you get every credit back
change «the button in yellow»
change «a dark background»
change «the title on the left»
change «a bigger title»
change «a rounded button»
Why it’s built this way
A form that stops sending doesn’t warn you. People just stop writing in.
It’s the most expensive failure a website has and the quietest: everything looks fine, the button responds, and for three weeks nobody gets in touch. That’s why the submission, the required fields, the consent and the antispam are set by the platform, out of reach of any redesign: yours, ours, or the AI’s.
Questions
What people ask before building a form
Are forms included in the free plan?
Yes. Forms, blocks and SEO come with every plan, the free one included, with no card and no expiration date. What changes with the plan are the quotas: submissions a month and attachment size.
Can I take payments inside a form?
Yes, with the payment field: a fixed amount or the value of a calculated field, say the deposit on a booking. The server calculates the amount from the validated values, and you get the notification when the gateway confirms the payment, not before. It uses the same gateways as the store: Culqi, Mercado Pago or Stripe. With no gateway set up, the form tells you before saving anything.
Where do submissions go?
To your panel, with their statuses and notes, and to your inbox, with the visitor’s address as Reply-To so you can answer from your own mail. Emails go out through a queue with retries, so a mail server hiccup doesn’t lose the notification. And you export them to CSV or JSON whenever you like. Webhooks, spreadsheets and CRMs aren’t there yet; they’ll come when three different customers ask.
Can I use the same form on several pages?
Yes. A form is just another block: you choose which one is drawn on each page and where it sits, without duplicating the schema. Every submission lands in the same inbox, and each one records which page it came from, where the visitor came from and with which campaign, in case you spread the same form around.
What if the visitor leaves the form halfway?
What they had is saved and they get a link to continue. A partial submission doesn’t count toward the limit, doesn’t notify you and, when completed, replaces the partial one instead of duplicating it. Partial submissions are where drop-off per step comes from: which question people leave at.
Can the AI remove a field or change where the form is sent?
No. The AI changes the look: columns, colors, typography, error states. Where it’s sent, which field is required, the consent and the antispam are validated by the server against the schema you saved, and a theme that doesn’t draw a required field doesn’t validate. It’s in the code, not in an instruction to the model.
How do you stop spam without a captcha?
With layers the visitor never sees: a honeypot field only bots fill in, a minimum fill time, a limit on submissions per IP and hour, and word and address lists. What lands in spam is flagged and can be reviewed, because every so often a real customer lands there. A captcha is under consideration: it affects the conversion of every form and isn’t a technical decision.
What about the personal data of whoever writes in?
A consent field with your own wording, the IP only if you decide to store it, attachments in a private folder with expiring links, and export and deletion on request. Exporting or deleting submissions is logged in the audit trail. Nothing goes to third parties unless you connect it.
Your next quote request, left halfway on Monday and finished on Tuesday.
Forms on every plan, the free one included. No credit card and no expiration date.