What is a form backend?

The definition

A website form needs two halves. The front half is the HTML your visitor fills in. The back half is a server that accepts the post, decides whether it is spam, keeps a copy and tells you about it. Static sites, site builders and front-end frameworks give you only the front half. A form backend supplies the other half as a service: you change the form’s action to the service’s endpoint and add a key that identifies your form.

The whole integration

<form action="https://submit.heartdove.com/v1/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <label>Email <input type="email" name="email" required /></label>
  <label>Message <textarea name="message" required></textarea></label>
  <!-- Hidden spam trap: people never see it, bots tick it -->
  <input type="checkbox" name="botcheck" tabindex="-1" autocomplete="off" style="display:none" />
  <button type="submit">Send message</button>
</form>

That is the entire integration. No PHP, no serverless function, no email library and no SMTP credentials in your project.

Form backend or form builder?

A form builder designs and hosts the form for you, usually as an embed or a page on the builder’s domain. That is quick, but the form looks like the builder’s form, loads the builder’s script, and lives outside your codebase.

A form backend leaves the form to you. Your markup, your CSS framework, your components, your accessibility work all stay as they are. The backend only takes over once the post leaves the browser. If you already have a form you like, you want a backend.

What a form backend does after submit

Accepts the post as a regular form submission or as JSON from fetch.
Screens it for spam with some mix of origin checks, rate limits, hidden trap fields, scoring and an optional human check.
Stores the submission so you have a record that does not depend on an email arriving.
Notifies you by email, and often by webhook or a chat or spreadsheet destination.
Answers the visitor with a confirmation page or a redirect to your own thank-you page.

The differences between services are in the details: whether the store comes before the send, whether you can see what happened to the notification, and what happens at the plan limit.

What to check before you choose one

These are the questions worth answering from each service’s own pages before you send a real enquiry through it.

Is the message saved before the email is sent?	If the email is the only copy, a bounce or a spam filter loses the enquiry. Look for an inbox that stores every submission first.
Can you see delivery status per submission?	Most services show nothing after the email leaves. You want accepted, delivered or bounced on each message, with the reason.
What happens over the limit?	Some services reject the submission, hide it until you pay, pause the whole site or bill overage. Held and released is the fair answer.
Is spam protection on the free plan?	Origin checks, rate limits and a hidden trap should not be paid features. A CAPTCHA should be optional, never required.
How long is history kept, and can you set it?	Thirty days on a free plan is common. You should be able to choose a shorter retention or none at all for sensitive forms.
Are webhooks signed?	An unsigned webhook can be forged by anyone who knows the URL. Look for a timestamped signature and a stable event ID.
Are monthly and annual prices clear?	Read the limits table and the plan cards side by side, and note whether a price is per month or billed yearly.
Where is the data stored, and under what terms?	You should be told the region and the processors before you send a single real enquiry.

How Heartdove answers them

Saved first. Every submission is stored in your inbox before any email or webhook is attempted.
Delivery you can see. Each message has its own timeline: captured, accepted by the provider, then delivered or bounced with the reason. A bounced address is paused and shown as a warning.
Held at the limit. Over the monthly allowance, submissions are held, visible, until the allowance resets, and released automatically, up to your plan’s hold capacity. There is no overage charge.
Spam checks on every plan. Exact origin matching, per-visitor rate limits, a hidden trap, spam scoring and quarantine. Cloudflare Turnstile is optional per form.
Retention you set. 90 days on Free, longer on paid plans, and each form can choose less. Privacy mode keeps no content at all.
Signed webhooks with a timestamped HMAC signature and a stable event ID, on every plan; during early access we connect your endpoint for you.
One pricing page that lists every limit. See pricing.

Is a form backend safe to use?

The access key in your page is public by design; it identifies the form and nothing else. What protects you is what the backend does with a post: Heartdove accepts submissions only from the website addresses you register, rate limits every visitor, stores keys only as hashes, isolates each workspace in the database, and signs every webhook. The security page lists exactly what is implemented. No certification is claimed.

Questions

Is there a free form backend?

Heartdove Free includes 500 submissions a month, an instant email alert for each, 90 days of history, delivery tracking and spam quarantine, with no card required.

Do I need a form backend if I use Next.js or a serverless platform?

You can write your own route and wire up an email provider. A form backend saves you the credentials, the retries, the bounce handling, the storage and the spam checks, and shows you the delivery result for every message.

Does a form backend work with WordPress or Webflow?

Yes. Paste the HTML form into a Custom HTML block or an Embed element. The form then posts to the backend instead of relying on the host to send mail.

What is a headless form backend?

The same thing. "Headless" stresses that the service has no form builder of its own: it receives whatever form you build and handles the rest.