Wufoo

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the form builder that replaces Wufoo.

This is the simplest category on this site and it is worth doing carefully anyway, because a form is where spam, accessibility and data protection all meet at once.

STACK
- Node 20+ with Fastify, server-rendered HTML with a little vanilla JS
- SQLite through better-sqlite3, WAL mode
- Caddy in front

THE DATA MODEL
- forms: id, slug, title, fields_json, notify_to, redirect_url, is_open, closes_at, max_entries
- entries: id, form_id, values_json, ip_hash, user_agent_bucket, created_at, spam_score
- files: id, entry_id, path, sha256, detected_type, bytes
- Field kinds: text, long text, email, number, date, choice, multiple choice, file, and a hidden field. Nine kinds cover almost everything

THE FORM ITSELF
- **Server-rendered HTML that works with JavaScript disabled.** A form that fails silently for a fraction of visitors is a form losing entries you never learn about
- Every field a real label, never a placeholder used as one. Errors announced, associated with the field, and the focus moved to the first one
- Required fields marked in text, not only in colour
- Keyboard-completable end to end

VALIDATION
- Validate on the server, always, and mirror it in the browser for convenience only
- On error, redisplay the form with everything the person typed still in it. **Losing a long answer to a validation error is the fastest way to lose the entry entirely**

SPAM, WITHOUT PUNISHING PEOPLE
- A honeypot field, hidden properly and never autofilled
- A minimum time-to-submit — a form completed in under two seconds is a machine
- Rate limit per IP hash
- **No CAPTCHA unless the first three fail.** A CAPTCHA costs real entries from real people, and it costs the most from people using assistive technology
- Score rather than block: hold suspicious entries for review instead of discarding them

FILES
- Direct to storage with a presigned URL, type detected from the bytes, size capped, served from a separate domain as an attachment

AFTERWARDS
- Notify by email with the entry inline, from your own domain, with SPF, DKIM and DMARC configured, and reply-to set to the submitter
- **Send the submitter a copy if they ask.** It costs nothing and it is the difference between a form and a black hole
- Export CSV with a stable column order, and a per-entry view

DATA PROTECTION, WHICH A FORM ALWAYS TOUCHES
- Say on the form what happens to the data and for how long it is kept
- A retention sweeper that actually deletes, and deletion on request
- Never log the field values in your web server logs

WHAT MATTERS MOST
Working without JavaScript, and repopulating on error. Between them they are most of the entries a badly built form loses.