Plain HTML form

The form

Set the form’s action to your form address and its method to POST. Keep your own markup and styling. The dashboard gives you this snippet with your address filled in.

Example form address. Use yours from the dashboard.

<form action="https://f.formparcel.live/f/f_k7QmXp2aVb9sTn4cLw8RhE" method="POST" onsubmit="if(!window.FormParcel){event.preventDefault();var f=this;f.setAttribute('data-fp-wait','1');setTimeout(function(){if(f.getAttribute('data-fp-wait')){f.removeAttribute('data-fp-wait');HTMLFormElement.prototype.submit.call(f)}},10000)}">
  <!-- Spam trap: people never see it, bots fill it in. Keep it hidden. -->
  <div aria-hidden="true" style="position:absolute;left:-10000px;">
    <input type="text" name="_gotcha" tabindex="-1" autocomplete="off">
  </div>

  <!-- Optional: send visitors to your own thank-you page. -->
  <input type="hidden" name="_next" value="https://your-site.example/thanks">

  <label for="name">Name</label>
  <input type="text" id="name" name="name" required>

  <label for="email">Email</label>
  <input type="email" id="email" name="email" required>

  <label for="message">Message</label>
  <textarea id="message" name="message" required></textarea>

  <button type="submit">Send</button>
</form>
<!-- FormParcel bot check: no cookies, no widget. Without it, submissions wait in your Spam folder. -->
<script src="https://f.formparcel.live/f/formparcel.js" async></script>

Field names

A field is sent only if it has a name. Each name becomes a column in the Sheet. If a form starts sending a name the Sheet has no column for, the lead is saved and waits as New fields to review. Nothing is dropped, and nothing is written to the Sheet until you review the new field in the dashboard. There you can add it as a column, or ignore it, for example a field a spam bot made up. An ignored field is left out of the Sheet, the lead keeps it, and you can stop ignoring it later in the form’s settings.

When several fields share a name, for example a group of checkboxes, their values are stored together as one value.

The spam trap

_gotcha is a field people should never see. Bots tend to fill in every field they find. If it arrives with any value, FormParcel drops the post: nothing is saved and no receipt is created. Hide the field by moving it off-screen, as the snippet does, and keep tabindex="-1" and autocomplete="off" on it so keyboards and password managers skip it.

The bot check

The script line after the form is FormParcel’s bot check:

<script src="https://f.formparcel.live/f/formparcel.js" async></script>

It does a short piece of work in the visitor’s browser and adds a hidden _fp_proof field to the form. It sets no cookies and shows nothing. Keep it on every page that has the form. Without it, or with JavaScript turned off, the form still posts and the lead is saved, but it waits in your Spam folder until you release it with Not spam. If the site has a Content-Security-Policy, allow the form endpoint host in script-src and connect-src. How it works is on Spam protection.

For a stronger check, a client site can turn on Cloudflare Turnstile: spam protection. The trap’s name, and what a script or a browser gets back when it is filled, are on special fields.

Your own thank-you page

Add a hidden _next field with the full address of a page on the client’s own site. After the lead is saved, FormParcel redirects the visitor there. Without it, the visitor sees a short FormParcel confirmation page. FormParcel only follows an address it can trust, and the rule is on special fields.

What the visitor sees

A browser form post gets one of two things: a redirect to a trusted _next, or a short, neutral FormParcel page such as “Your message was sent”, or a plain explanation when something went wrong. Neither shows the receipt ID, and each page has a “Report abuse” link to our contact page. Anything that is not a browser form post gets JSON instead: the fetch guide. Every answer is on Responses and error codes.

What is not accepted

• File inputs. A file in the post is refused (FILE_UPLOAD_NOT_SUPPORTED), so leave them out of the form.
• Fields named like a password or a card detail. They are refused (PROHIBITED_FIELD).
• A post with no readable value in any field (EMPTY_SUBMISSION).

The limits on size and fields are on Limits and retention.

Check it

Send a test lead from the form’s page in the dashboard, then post the form once from the client’s site and open its receipt under Leads. If nothing arrives, go through Troubleshooting.