HTML, JSON, and multipart ingest
Accept native form posts, JSON requests, and file uploads on one endpoint. Field names are preserved, including repeated values and nested keys.
Features
A form backend with the boring parts already built.
Ingest, validation, storage, email, files, webhooks, and delivery records. Use only the pieces you need; the endpoint stays the same.
Server-side rules
Require fields, block specific values, mark suspicious submissions as spam, or route based on a field. Rules run before quota is counted.
Verified recipients
Recipients confirm once by email. Unverified submissions are stored as pending and delivered automatically after confirmation, with a resend cooldown.
Per-channel delivery records
Owner email, autoresponse, and webhook attempts are recorded separately with status, error detail, and a manual retry action.
File uploads with limits
Allow only the file types you expect, cap the number and size per form, and expire attachments on a retention schedule.
Custom notification templates
Set the subject and body for owner notifications using submitted field variables and an attachment summary.
Signed webhooks
Deliver events to HTTP endpoints, Discord, or Telegram. Payloads are signed with HMAC-SHA256 and failed attempts are retried.
Partial submissions
Save progress before the visitor finishes, then send a resume link. A completed submission merges into the original record.
Spam and abuse controls
Custom honeypot fields, optional Turnstile, per-form rate limits, origin allowlists, and a suppression list for bad addresses.
Analytics and CSV
See daily volume, sources, UTM parameters, device type, and failed deliveries. Export submission data as CSV.
API and embed script
Use account-scoped API keys for submissions and delivery records, or drop in /embed.js for inline status messages.
Bring your own SMTP
Connect a sending domain with a TXT ownership record and encrypted SMTP credentials, or use the default sender.
Current defaults
Limits, in plain language.
These are the defaults in the current early-access build. Per-account limits can differ.
| Area | Default | Notes |
|---|---|---|
| Recipients | 5 per form | Duplicates are removed; each address must be verified. |
| Files | 5 per submission, 25 MB each | MIME and extension allowlist applies. |
| Attachment retention | 90 days | Configurable; expired files are removed by a sweep. |
| Rate limit | 20 submissions per minute per form and IP | Forms are isolated from each other. |
| Request body | 64 KB | File uploads use multipart limits instead. |
| Webhook attempts | 5 | Each attempt is recorded; replay is available. |
Feature questions
Does FreelyForm replace my form builder?
No. It is the backend behind your form. You can use plain HTML, a framework component, or an existing builder that can post to a custom endpoint.
Can I validate fields before accepting a submission?
Yes. Require, block, spam, and route rules run on the server. A failing require rule returns a 422 response with the missing fields, and blocked or spam submissions can be stored without sending mail.
Can I send submissions to more than one place?
Each form supports up to five verified email recipients plus an autoresponse to the submitter. Webhook endpoints, Discord, and Telegram can receive the same event.
Put your forms on a backend that keeps a record.
Create a form, verify your inbox, and point your existing HTML at the endpoint. No server, no SDK, no rewrite.
POST https://freelyform.com/f/FORM_ID