Add a working contact form

Static sites can't process a form on their own. Fylo Forms gives each site an endpoint that receives submissions, filters spam, emails you and keeps the leads in your dashboard. Pro and Business plans.

Set it up

1. Open Forms in the dashboard, choose the site and click Enable. You get a snippet like this:

<form id="fylo-form" method="POST" action="https://fylo.host/api/forms/YOUR_KEY">
  <input type="hidden" name="fylo_ts" value="">
  <input type="hidden" name="fylo_redirect" value="">
  <div style="position:absolute;left:-9999px;" aria-hidden="true">
    <label>Website</label>
    <input type="text" name="fylo_website" tabindex="-1" autocomplete="off">
  </div>

  <input type="text" name="name" placeholder="Your name" required>
  <input type="email" name="email" placeholder="Your email" required>
  <textarea name="message" placeholder="Your message" required></textarea>
  <button type="submit">Send</button>
</form>
<script>
(function () {
  var f = document.getElementById("fylo-form");
  if (f && f.elements["fylo_ts"]) { f.elements["fylo_ts"].value = Date.now(); }
})();
</script>

2. Paste it into your page where the form should appear and upload the site again (Replace File).
3. Submit a test message. It arrives by email and appears under Forms → Leads.

Each site has one form endpoint. You can use the same snippet on several pages of that site.

Make it yours

• Fields — add, remove or rename any visible inputs (phone, company, budget, checkboxes, selects). Every named field is saved and included in the email.
• Styling — it is plain HTML; style it with your own CSS.
• Thank-you page — put a full URL in the hidden fylo_redirect input (https://example.com/thanks.html) and visitors land there after sending. Set this: without it the browser shows a bare confirmation response instead of one of your pages.
• Stay on the page instead — send the form with JavaScript and show your own message. The endpoint accepts a normal form body or JSON and answers { "ok": true }:

<script>
document.getElementById("fylo-form").addEventListener("submit", function (e) {
  e.preventDefault();
  var f = e.target;
  fetch(f.action, { method: "POST", body: new FormData(f) })
    .then(function (r) { return r.json(); })
    .then(function (d) { f.innerHTML = d.ok ? "<p>Thanks — we will be in touch.</p>" : "<p>Something went wrong. Please try again.</p>"; });
});
</script>

• Keep the three fylo_* inputs and the small script. They are the spam protection; without them real messages may be treated as spam.

Where leads go

• Email — each real submission is emailed to your account address. Change the address or the subject line in the form's settings; a new address has to be confirmed from its inbox before it is used.
• Dashboard — Forms → Leads lists every submission with its fields, email, country and time. Delete any you don't need, or Export CSV for a spreadsheet or CRM.

Spam protection

Three layers run before a lead is counted: rate limiting per sender, a hidden honeypot field that only bots fill in, and a time check that rejects forms sent faster than a person could type. Caught submissions are kept out of your inbox and don't count against your monthly limit. Bots always see a normal success response, so they don't learn to adapt.

Limits

The counter resets each month and is shown on the Forms tab. When the limit is reached, further submissions are rejected (the endpoint answers quota_exceeded) until the next month or an upgrade, so keep an eye on the meter if a campaign is running.

Your visitors' data

You decide what your form collects and why; Fylo stores it for you along with the sender's IP address and country (used for spam protection). Tell your visitors in your own privacy notice. Details: Privacy Policy and Terms.

From an AI app

With the MCP server connected, "add a contact form to my portfolio site" enables the form, places the snippet in the page and republishes; "any new leads this week?" reads them back.