FormMail replacement
Replace FormMail without rebuilding your form.
FormMail scripts have powered contact forms since the 1990s: a CGI or PHP file on your server that turns a form post into an email. If your site still relies on one, you can keep the form and swap the script for a hosted endpoint in a few minutes. Every message is then saved first and its email alert tracked until it is delivered or bounces.
Updated 28 October 2026
Why replace a FormMail script
- It needs a server that runs it. A Perl or PHP script needs CGI or PHP on your host. Static hosting, site builders and many modern hosts do not offer either.
- The script is yours to keep safe. Older FormMail versions read the recipient from the form itself, which let spammers use them to send mail to anyone. Even a patched copy is code on your server that you have to update.
- Mail from your web server often lands in spam. A script that sends through the host’s mail function usually lacks the authentication that inbox providers now expect, and you never find out an enquiry went missing.
- There is no record. The email is the only copy of the message. If it is lost, the enquiry is gone.
FormMail fields and what to use instead
| FormMail field | With Heartdove |
|---|---|
recipient | Remove it. Alerts go to the address held in your Heartdove account, never one written in the page, so nobody can redirect your form’s mail. |
subject | Keep it. A field named subject becomes the subject line of the alert and the heading of the message in your inbox. |
email | Keep it. It becomes the alert’s reply-to address, so you can answer straight from your email. |
realname | Rename it to name, so the alert shows it as the sender’s name. Kept as realname, it still arrives as an ordinary field. |
redirect | Rename it to _redirect, with the full address of your thank-you page. It must be on a website registered for the form. |
required | Remove it and add the required attribute to those inputs instead, so the browser checks them before sending. |
Display and report options such as sort or env_report | Remove them. Every field arrives in your inbox and the alert under the name you gave it. |
Before and after
A typical FormMail form:
<form action="/cgi-bin/formmail.pl" method="POST">
<input type="hidden" name="recipient" value="you@yourdomain.com" />
<input type="hidden" name="subject" value="Website enquiry" />
<input type="hidden" name="redirect" value="https://www.yourdomain.com/thanks.html" />
<input type="hidden" name="required" value="realname,email" />
<input type="text" name="realname" />
<input type="text" name="email" />
<textarea name="message"></textarea>
<input type="submit" value="Send" />
</form>The same form posting to Heartdove. The hidden botcheck field is a spam trap: people never see it, and bots that tick it are quarantined instead of alerting you.
<form action="https://submit.heartdove.com/v1/submit" method="POST">
<input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
<input type="hidden" name="subject" value="Website enquiry" />
<input type="hidden" name="_redirect" value="https://www.yourdomain.com/thanks.html" />
<label>Name <input type="text" name="name" autocomplete="name" required /></label>
<label>Email <input type="email" name="email" autocomplete="email" required /></label>
<label>Message <textarea name="message"></textarea></label>
<input type="checkbox" name="botcheck" tabindex="-1" autocomplete="off" style="display:none" />
<button type="submit">Send</button>
</form>Switch in four steps
- Create a free Heartdove form and register your website address. Registering
www.yourdomain.comcoversyourdomain.comtoo. - Change the form’s
action, add your access key and the spam trap, and map the fields as in the table above. - Send yourself a test message and check it in your inbox, with its delivery timeline.
- Delete the FormMail script from your server, so it can no longer be called by anyone.
Questions
Do I need Perl, PHP or CGI on my host?
No. The browser posts the form straight to Heartdove, so the page can be plain HTML on any host, including static hosting.
Can spammers use the form to send mail to other people?
No. The page carries no recipient address. Alerts go only to the address held in your Heartdove account, and posts are accepted only from the websites registered for the form.
Is there a free plan?
Yes. Free includes 500 submissions a month with an instant email alert for each, 90 days of history, delivery tracking and spam quarantine. No card is needed.
Can visitors attach files, as some FormMail versions allowed?
Not yet. Heartdove accepts text fields only, so remove any file inputs when you switch.
Never lose another enquiry.
Connect your first form in a few minutes. Your existing design stays exactly as it is.