Documentation

Getting started

Step 1 - Sign up and your first Form

If you haven't already, sign up for an account with us. Once you are logged in, you will land on the "Forms" page with one Form ready to go.

Step 2 - Verify your email addresses

To be able to send you emails, we need to verify the email address on your Account and on each Form. We send you a verification email when you sign up, but if you need to send it again, you can do so from the "Forms" page.

Step 3 - Your first form

On your first Form, click on the Settings button and fill in your desired settings.

Optionally you can also customise and test your form by clicking on the Form . This is especially useful for checking you have your Captcha or redirect set up correctly and generating a form with little coding knowledge.

Step 4 - Install it on your website

Once you are happy with your Form, clicking on the HTML button will generate your base HTML form ready to be copy and pasted into your website.

You should now have a fully operational form that will now post the forms data directly to your inbox!

Manually

If you wish to build your own form from scratch or make API calls directly, no problem! You can do so using the following url endpoint:

HTML Example

Step 5 - Test it out

Boot up your website, fill in your new form and send yourself an email!

Step 6 - Customize it

You can now edit the form however you wish, and if it posts legitimate data, we'll relay this to your inbox or show an error page.

You can also add a custom redirect to a handcrafted thank you page or add recaptcha for extra protection.

Forms page

The forms page is the main page of the application, from here you can view your plan, monthly stats and Forms.

And you can view the Forms you have:

Form builder and testing

From the Form page, you can click on Form which will load the form builder and testing area for that form.

This is a fully operational form, which you can then build out and test.

Once you are happy with the form, click the Save and exit , bottom right - and then click HTML button on Form which will then generate your customised HTML form for you to easily copy and paste into your website.

HTML Form generator

From the form page, you can click on a Forms HTML to generate your forms HTML for you to copy and paste into anywhere you want to display the form.

Form settings

The following parameters can be set for each Form by clicking on a Forms Settings button.

Form Name

You can give your form a custom name for ease of management. Otherwise it will just display the email address that it sends the data to.

Email Address To Send Form Data To

This is where the form will send it's submitted data to. You can changed this at anytime. If you change it to an email address we don't recognise, you'll need to revalidate it before it will work.

Subject line

You can set a custom subject line to the form data email that gets sent to you, so you can easily find it in your inbox.

Return url

If you want to use your own thank you page rather than ours, you can set the return url on a Form to tell our system where to redirect to once a form has been submitted.

For example, if you have a thank you page you have created at https://example.com/thank-you, set a Form Return Url to that url, test the form is redirecting correctly and you're good to go.

Email notification subject line

When our system emails you, you will be given a generic email subject line like Static Contact Form submission because we don't know what you are using it for. But it's very likely you will use it for a specific website, so you can change the Form's Email notification subject to something more relevant - eg: example.com Form submission.

Whitelisting domains

You can easily whitelist domains by adding domains to the Form Whitelist. This will then limit all requests to the domains provided and block any requests that come from other domains.

We check the domain the browser reports the form was submitted from (the Origin or Referer header). Subdomains of a whitelisted domain are allowed automatically, so adding example.com also covers www.example.com. If a visitor's browser or privacy extension strips these headers entirely we won't block the submission, but it does count towards their spam score.

It's a simple and effective way to help limit how your form can be abused but won't stop spam bots submitting the form through your website or spoofing the the request domain so it should always be used with other spam prevention methods, like a captcha solution.

Local development

If you want to be able to test sending emails from localhost, either leave the Whitelist empty, in which case it will accept all requests from all domains, or add 'localhost' to the Whitelist. Just make sure to remove it once development has been completed.

Captcha

You can add your captcha site and secret keys here to enable extra protection from unwanted spam.

Simply select the captcha provider you want to add and copy and paste the site and secret keys into the relivant fields.

Allow API calls

Toggles your API on and off. By default, this is turned off.

If you have enabled it, the same end point will now accept and return json.

Example in Javascript:

Set up a captcha

Static Contact Botbuster

Built in — nothing to install or sign up for.

Our own invisible spam filter: a hidden honeypot field, a signed timing check and a background proof-of-work check, all handled by a small script already included in every Form's generated HTML. This is what runs when the 'Captcha' dropdown is left on its default.

What you will need

• Nothing to sign up for — the honeypot field and timing check are generated and verified by Static Contact itself.
• The static_contact_botbuster.js script include in your form's HTML (already there if you copied it from the HTML button).

How it works

The script adds a field real visitors never see and a signed timestamp of when the form was loaded. A submission is blocked if that hidden field has been filled in (a dead giveaway a bot is auto-filling every field it finds), or if it arrives with no timing token at all, or suspiciously fast for a human to have read and filled the form.

It also runs a small proof-of-work calculation quietly in the background while the form is being filled in — real computational cost a script has to pay, not just a timer to wait out. It's invisible: no puzzle, no checkbox, nothing for a visitor to notice or interact with.

Turning it on

Nothing to do — leave the 'Captcha' dropdown on 'Static Contact Botbuster' (the default) and make sure the HTML button's generated script tag stays in your form.

Example

ALTCHA

Website

Open-source, self-hosted proof-of-work captcha. No account, no site key, no secret key — we generate and verify the challenge ourselves.

What you will need

• Nothing to sign up for — the challenge is generated and verified by Static Contact itself.
• Access to the website you want to embed your form into.

Turning it on

Find the Form you want to protect and click the Settings . Then find and select 'ALTCHA' from the 'Captcha' dropdown — there are no site or secret key fields to fill in for this option.

Click Save and test your form by clicking on the Form to make sure you are getting no errors.

Once you are happy with it, simply click the HTML on the same form. This will now generate you an ALTCHA ready form which you can copy and paste into your website.

Load your website in a browser and you should see the ALTCHA widget load on your site's form, which should now be protected by ALTCHA — solved quietly in the visitor's browser with no visible puzzle in most cases.

Docs

Example

Cloudflare Turnstile

Website

A verification tool to replace CAPTCHAs

What you will need

• You will need a Cloudflare account, sign in or you can create a new account for free.
• Your Turnstile site and secret keys
• Access to the website you want to embed your form into

Get your Site and Secret keys, and what to do with them

Once you have signed up or logged into your account

1. Click the "Turnstile" like from the left hand menu.
2. Click on "Add widget"
3. Give it a name, like your website address (eg: example.com)
4. Click on "Add host names", this will bring up an overlay where you can add urls to whitelist
5. Add your own domain name (eg: example.com) and staticcontact (ie: staticcontact.com)
6. Click "Add" down the bottom to save these into the Widget
7. Select a Widget mode
8. Click on "Create"

You will now be presented with your Site key and Secret key.

SITE KEY: Your client side, 'Site Key' is for public use only, and will need to be added to your form to make it work.

Copy this key and go to Static Contact in a different browser tab or window. Find the Form you want to add turnstile to and click the Settings . Then find and select 'Cloudflare Turnstile' from the 'Captcha' dropdown. Paste your Site Key into the 'Site Key' field.

SECRET KEY: Your server side, 'Secret Key' is backend use only, and will need to be added to your Static Contact Form to make it work.

Head back to your Turnstile page, copy the Secret key and paste the 'Secret key' into the matching 'Secret key' field in Static Contact.

Click Save and test your form by clicking on the Form to make sure you are getting no errors.

Once you are happy with it, simply click the HTML on the same form. This will now generate you a Turnstile ready form which you can copy and paste into your website.

Load your website in a browser and you should see Turnstile load on your site's form, which should now be protected by Turnstile.

Docs

Example

Friendly Captcha

Website

A privacy-first, GDPR-strict captcha. No cookies, no personal data, no tracking — just a proof-of-work puzzle solved quietly in the visitor's browser.

What you will need

• You will need a Friendly Captcha account, sign in or create a new account (free 30-day trial, no credit card required).
• Your Friendly Captcha sitekey and API key
• Access to the website you want to embed your form into

Get your Sitekey and API key, and what to do with them

Once you have signed up or logged into your account:

1. Go to the "Applications" page in your dashboard.
2. Click "+ New Application" and give it a name, like your website address (eg: example.com).
3. Your new application's sitekey is shown under its name (it always starts with the letters "FC").
4. Go to the "API Keys" page in your dashboard and create an API key — this is what Static Contact uses to verify submissions with Friendly Captcha on your behalf.

SITE KEY: Your client side, 'Site Key' is for public use only, and will need to be added to your form to make it work.

Copy your sitekey and go to Static Contact in a different browser tab or window. Find the Form you want to add Friendly Captcha to and click the Settings . Then find and select 'Friendly Captcha' from the 'Captcha' dropdown, and paste your sitekey into the 'Site Key' field.

SECRET KEY: Your API key is backend use only, and goes in Static Contact's 'Secret Key' field — it plays the same role here that a 'Secret Key' does for the other captcha providers.

Copy your API key from the "API Keys" page and paste it into the matching 'Secret key' field in Static Contact.

Click Save and test your form by clicking on the Form to make sure you are getting no errors.

Once you are happy with it, simply click the HTML on the same form. This will now generate you a Friendly Captcha ready form which you can copy and paste into your website.

Load your website in a browser and you should see the Friendly Captcha widget load on your site's form, which should now be protected by Friendly Captcha.

Docs

Example

Google reCaptcha

Website

Google reCAPTCHA is a free service that protects your site from spam and abuse. It uses advanced risk analysis techniques to tell humans and bots apart.

What you will need

• You will need a google account, sign in or you can create a new account for free.
• Your Google reCaptcha site and secret keys
• Access to the website you want to embed your form into

Get your V3 site and secret keys

Once you have a Google account, you can set up a new reCaptcha site.

Follow their instructions, selecting reCAPTCHA type V3 and make sure you fill in the domains correctly.

Hit save and you should be presented with your very own reCAPTCHA key and secret.

What to do with your site and secret keys?

You need to copy the keys to Static contact so that we can manage the verification calls with Google on your behalf.

SITE KEY: Your client side, 'Site Key' is for public use only, and will need to be added to your forms submit button to make it work.

From Google Recaptcha, copy your Site Key, then in Static Contact, find the Form you want to add reCaptcha to and click the Edit . Then find and and click the "Captcha" drop down, select Google reCaptcha, and then paste the key into the 'Site Key' field. Now return to the Google recaptcha website to get your Secret Key.

SECRET KEY: Your Secret Key is for back-end code only.

In Google Recaptcha, copy your Secret Key, return to Static Contact and paste the key into the 'Secret Key' field.

Once both fields have your keys in them, click the Save and test your form by clicking on the Form to make sure you are getting no errors.

Then simply click the HTML on the same form. This will now generate you a Google reCapthca ready form which you can copy and paste into your website.

Load your website in a browser and you should see the reCaptcha logo load on your site, and your form should now be protected by Google reCaptcha and be relaying through Static contact to your inbox.

Docs

Example

hCaptcha

Website

Solve your fraud and abuse problem today. Instantly detect and deter human and automated threats.

What you will need

• You will need a hcaptcha account, sign in or you can create a new account for free.
• Your hCaptcha site and secret keys
• Access to the website you want to embed your form into

Get your Site and Secret keys, and what to do with them

SITE KEY: Your client side, 'Site Key' is for public use only, and will need to be added to your form to make it work.

Log into hCaptcha and you will be presented with the hCaptcha Dashboard, look for the "add site" button halfway down the page.

Fill in the form details, making sure to add the correct details.

You will now see a list of your hCaptcha instances, clicking on one will allow you to get your first 'Site key', which is a unique public ID you use on your site or app.

Copy this key and head back to Static Contact, find the Form you want to add hCaptcha to and click the Settings . Then find and select 'hCaptcha' from the 'Captcha' dropdown, paste your Site Key into the 'Site Key' field.

SECRET KEY: Your server side, 'Secret Key' is backend use only, and will need to be added to your Static Contact Form to make it work.

In hCaptcha, click on your profile icon, top right, and select 'Settings'.

Your top item should be an account level secret - generate one if you don't have one already, and copy the code.

In Static Contact and paste the 'Secret key' into the matching 'Secret key' field.

Click Save and test your form by clicking on the Form to make sure you are getting no errors.

Once you are happy with it, simply click the HTML on the same form. This will now generate you a hCaptcha ready form which you can copy and paste into your website.

Load your website in a browser and you should see hCaptcha load on your site's form, which should now be protected by hCaptcha.

Docs

Example

Migrating from Netlify Forms

Netlify Forms processes your data-netlify="true" markup at build time on Netlify's platform, so the moment a site is hosted anywhere else those forms post into the void. Migrating to Static Contact takes about 5 minutes, two ways:

Option 1 - the compatibility script (no markup changes)

Keep your existing Netlify form markup exactly as it is and add one script tag before your closing </body>:

The script finds every form[data-netlify] on the page and points it at your Static Contact Form. Your field names are kept, the form-name hidden field convention is kept, a netlify-honeypot field is converted to our honeypot, and our bot protection is added automatically. If one page has multiple forms delivering to different inboxes, add a data-key="{ access code }" attribute to the individual <form> tag.

Option 2 - point the form at us directly

Remove the data-netlify and netlify-honeypot attributes and set the form's action instead:

Static site generator notes

Astro - forms in .astro components are plain HTML; use either option above. If your form lives in a component rendered with client:only, prefer Option 2 since the compatibility script runs on page load and may miss late-rendered forms.

Hugo - update the form partial (commonly layouts/partials/contact-form.html) using Option 2, or drop the compatibility script into your base template.

Eleventy - forms in Liquid/Nunjucks templates are plain HTML at build time; both options work as-is.

Next.js static export - for plain <form> elements both options work. If you submit via fetch() (the common Netlify AJAX pattern posting to "/"), point the request at https://staticcontact.com/send/{ your access code } with application/x-www-form-urlencoded body instead, or enable API access on your Form and send JSON.

What doesn't carry over

Netlify's dashboard submission archive and their form notification settings stay behind on Netlify - export anything you need before you close the account. Your Static Contact submissions are delivered straight to your Form's email address (and to a webhook or chat app, see below).

Webhooks & chat notifications

On paid plans you can have every submission delivered to one or more URLs or chat apps, in addition to email. Configure it under your Form's Webhooks tab. Choose a type:

• Generic - we POST a signed JSON payload to your endpoint. Full payload + verification reference: webhooks for form submissions.
• Slack / Discord / Telegram - paste an incoming-webhook URL and we POST a formatted message. Step-by-step setup guides: Slack, Discord, Telegram (Telegram uses a https://api.telegram.org/bot<token>/sendMessage?chat_id=<id> URL).

Generic payload

{
    "form":       { "id": "...", "name": "example.com", "email": "you@example.com" },
    "submission": { "id": 123, "data": { "email": "jane@acme.com", "message": "Hi!" }, "received_at": "2026-06-07T12:00:00+00:00" }
}

Verifying the signature

When you set a signing secret, every generic request carries a X-StaticContact-Signature header of the form sha256=<hmac>, where the HMAC is HMAC-SHA256(raw_request_body, your_secret). Verify it before trusting the payload:

<?php
$secret   = 'your-signing-secret';
$body     = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $body, $secret);

if (! hash_equals($expected, $_SERVER['HTTP_X_STATICCONTACT_SIGNATURE'] ?? '')) {
    http_response_code(401);
    exit('invalid signature');
}

$payload = json_decode($body, true);

Always compare with a constant-time function such as hash_equals(). Chat notifications (Slack/Discord/Telegram) are not signed - those providers authenticate the request via the secret embedded in the incoming-webhook URL.