A new address becomes a lead
With the owner, source and tags the form was configured with, in the queue, on both the web app and the phone.
One snippet, no key, no account
A Form on Your Site. A Lead in Your CRM.
Build the form in Settings, paste one line into your website, and what people fill in arrives here with its owner, source and tags already set. Nobody retypes anything.
Unlimited forms and unlimited submissions. MIT licensed, self-host it anywhere.
Paste it and it works
You choose the questions and which lead field each one writes into. The CRM writes the snippet, with the right absolute address already in it.
- No key on your page The snippet carries nothing secret One line of HTML, an iframe or a script tag, and nothing in it is a credential. The visitor needs no account either. What the snippet identifies is which form to render, and a form that is not published accepts nothing.
- Publishing checks the form It refuses a form that would lose leads Publishing is its own action, not a checkbox on save, and it will not run without an email field, because that is what lets a returning visitor update the lead you already hold. A form set to redirect on success has to say where.
- Two embeds A frame, or rendered into your page The iframe is self-contained and inherits nothing from your site, which is the safe default. The script version renders into a div so it picks up your own layout. Both are generated for you with the right absolute URL.
[ ACMEWIDGETS.COM/CONTACT ]
The moment somebody hits send
One submission, one lead, no duplicates
The interesting case is the second submission from the same person, which is where a form that only ever inserts starts making a mess of your list.
A returning address updates the one you have
Matched on email regardless of capitalisation. It fills in what was blank and never overwrites what was already there, so nobody who knows your prospect’s address can rewrite that record through your own form.
A second message is a comment, not an edit
The message field lands on the lead’s timeline. The first one is not replaced by the second.
The owner and the notify list get an email
Once per accepted submission. Rejected ones tell nobody, because an inbox full of blocked bots is an inbox somebody stops reading.
Everything is kept, accepted or not
The submission log holds the rejected ones too. Without them there is no spam review, and the conversion rate silently counts only the ones that worked.
Your custom fields work here too
Any custom field you have defined on leads can be a question on the form, validated by the same rules the rest of the app uses.
Because it is a public endpoint
A published form accepts posts from anyone
It has to. The whole point is that a stranger can fill it in without an account. So the controls are on by default rather than being a setting you find out about afterwards.
A honeypot, always on
A field no human sees and no human fills. A submission that fills it is recorded as spam, writes no lead, and is told the same thing a real one is told. A bot that can tell it was caught comes back different.
Two rate limits, always on
One per visitor per form, one for the whole form across everybody. The second is the one that matters: the header a per-visitor limit counts on can be forged, and rotating it does nothing to a per-form cap.
Disposable addresses refused
Throwaway inbox domains are rejected before a lead is written. On by default, and switchable per form.
Cloudflare Turnstile, if you want it
Optional, off by default, configured per form. It fails closed: a timeout or an unreachable Cloudflare refuses the submission rather than waving it through, because otherwise an attacker’s first move is to make Cloudflare unreachable. Your secret is write-only and never comes back out of the API.
Restrict it to your own domains
List the origins allowed to use the form and browsers enforce it, for both framing and posting. Worth knowing what that is and is not: it stops another website from mounting your form, and it is not a defence against a script, because a script sets those headers itself. The rate limits and the captcha are what apply there.
The lead cannot be steered
A form can only write the fields you put on it, and only into the fifteen lead columns a form is allowed to touch. Owner, pipeline stage, probability and deal value are not among them, whatever a submission claims.
What you can actually measure
Thirty days, per form
This is the whole list. There is no A/B testing, no funnel builder and no attribution model, so this page does not claim them.
Views
How many times the form rendered on your site, per day.
Submissions
Accepted ones, including the returning visitors who merged into a lead you already had.
Spam blocked
What the honeypot, the captcha and the address rules refused, per day.
Conversion rate
Submissions over views across the trailing thirty days.
A live-but-silent warning
A published form that has heard nothing in a month is flagged in Settings. Usually the snippet came off the page and nothing else would tell you.
The submission log
Every post to the form, what it contained, and whether it became a lead.
Questions
Before you put it on your homepage
Still not sure?
The source is public. Read the spam controls before you trust a word on this page.
Do I need to write any code?
No. You build the form in Settings, choose which lead field each question writes into, and copy the snippet it gives you into your site. If your site is WordPress, Webflow, Squarespace, plain HTML or anything else that lets you paste an embed, that is the whole job. The API is there if you would rather post the form yourself.
What stops somebody spamming it?
A hidden honeypot field, a per-visitor rate limit, a per-form rate limit that header rotation cannot evade, and rejection of disposable email domains. All four are on by default and none of them can be switched off by accident. Cloudflare Turnstile is available per form if a determined bot finds you, and it fails closed rather than open.
What happens if the same person fills it in twice?
You get one lead, not two. The second submission fills in anything that was blank and leaves everything already recorded alone, and the message goes onto the lead as a comment. That rule is deliberate rather than convenient: anyone who knows an address can post your public form, so allowing an overwrite would let a stranger rewrite that person’s record.
Can I put it on more than one site?
Yes, and you can build a different form per site or per campaign. Each one has its own fields, owner, tags and analytics, so the numbers tell you which page is working. Restrict each form to the origins you expect it on.
Where does the data go?
Into your own database. This is the same self-hosted CRM as everything else on this site: the form posts to your backend, not to ours, and no third party sits in the middle. If you turn on Turnstile, that one check is the only outbound call, and it goes to Cloudflare with a secret you supply.
Is there a limit on forms or submissions?
Not from us. There is no per-form fee, no submission quota and no seat cap, because there is no billing. The per-form rate limit is a spam control with a default you can raise for a busy page, not a plan boundary.
Stop retyping your contact form
No per-form fee, no submission quota, no trial clock. Host it yourself, or let MicroPyramid run it.