Formspree

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me a form endpoint that replaces Formspree: my static site posts to it, the submission arrives, and the spam does not.

STACK
- Node 20+ with Fastify
- SQLite through better-sqlite3, WAL mode
- No client-side framework — this must work from a plain HTML form with no JavaScript at all
- Caddy in front

THE DATA MODEL
- forms: id, uid, name, target_emails_json, redirect_url, allowed_origins_json, is_active, requires_captcha, created_at
- submissions: id, form_id, payload_json, spam_score, spam_reasons_json, status, ip_hash, referrer, user_agent_bucket, country, created_at — status is delivered, queued, spam or rejected
- files: id, submission_id, field, path, sha256, mime, bytes, scan_status
- deliveries: id, submission_id, target_kind, target, status, attempts, response_excerpt, at
- blocklist: id, kind, value, reason, added_at — an address, a domain, a phrase, an address hash
- Every submission stored, including the ones judged spam. A false positive that was silently dropped is a customer you never knew wrote to you

THE ENDPOINT
- POST to /f/:uid as form-encoded or multipart, exactly as a browser sends it
- Answers with a redirect to the form's thank-you page, or with JSON if the request asked for JSON. Both paths must work
- No JavaScript required anywhere. The whole point is a static site with an ordinary HTML form
- Origin checked against the form's allowed list, and a submission from elsewhere is rejected and recorded
- Field names taken as they come; no schema required, because the form's author owns the fields
- Reserved fields for the redirect, the subject and the reply-to address, all validated

SPAM, WHICH IS THE ENTIRE PRODUCT AFTER WEEK ONE
- A honeypot field, documented, that a real form includes hidden and a bot fills in
- A minimum time between the page being rendered and the form arriving, carried in a signed token. Bots post instantly
- Rate limits per address hash, per form and globally, with a burst allowance
- Content signals scored rather than judged: link count, all-capitals, a body that is a URL, known spam phrases, a mismatched or absent referrer, a user agent that is a library
- A score with the reasons attached, and a threshold per form. Above it the submission is held for review, not discarded
- Optional third-party spam checking, off by default, and the README says plainly that turning it on sends the submission text to somebody else
- A review queue where a held submission can be released, and releasing one teaches the blocklist in reverse

DELIVERY
- Email to one or more addresses, with the fields formatted readably and the reply-to set to the submitter's address if one was given — so replying works, which is what people actually want
- Webhook with an HMAC signature, retried with backoff, idempotent by submission id
- Optional forwarding into a spreadsheet or an automation tool through the same webhook machinery
- Every attempt recorded with the response
- A daily digest option instead of one email per submission, for a busy form

FILES
- Multipart upload streamed to disk, never buffered whole
- Type from content, not from the filename; a size cap and a per-form quota
- Executables and archives refused by default with a clear message
- Scanned if a scanner is configured, and held until the scan finishes
- Stored outside the web root and served through a signed, expiring link in the notification email — never attached, because attachments are what get the notification itself marked as spam

THE DASHBOARD
- Submissions per form, searchable, with the spam ones in their own tab
- Export CSV and JSON, complete, in one click
- The form's own snippet shown ready to paste, with the honeypot and the token included
- Dark and light

DELIVERABILITY
- Send from your own domain with SPF, DKIM and DMARC configured — the README lists the records
- The From address is yours; the submitter's address is only ever the reply-to. Sending as somebody else's domain is how you get your mail rejected everywhere
- Bounces consumed and a failing target address flagged rather than retried forever

OPERATIONS
- .env: DATABASE_PATH, STORAGE_PATH, BASE_URL, SMTP_URL, FROM_ADDRESS, SESSION_SECRET, HASH_SALT, SIGNING_SECRET
- Migrations on boot, each once
- Nightly backup off the machine, restore script
- Health endpoint that checks the mail connection

WHAT MATTERS MOST
Spam scoring with reasons, and never dropping anything. Build the honeypot, the timing token and the review queue first, then leave a form public for a fortnight and read what arrives. Every homemade form endpoint works beautifully for three weeks and then becomes a stream of casino links.

Give me the repository, migrations, .env.example, the HTML snippet, and a README with deploy steps behind Caddy and the mail DNS records.