Every HTML form has an action — the address
submissions are sent to. It's the one part of a form that HTML can't do for
you, and the part that confuses everyone the first time. Here are your
options, from easiest to most technical.
When someone presses Send, the browser bundles up the field values and
delivers them to the URL in your form's action attribute:
<form action="https://example.com/your-endpoint" method="POST">Whatever lives at that URL receives the data. The form itself neither stores nor sends anything — it's an envelope, and the action is the address on it. No address, no delivery.
A form backend is a service that exists precisely to be that address. You sign up, it gives you a URL, you paste the URL into your form's action — done. When someone submits the form, the service emails you the submission and keeps a copy you can browse or download as a spreadsheet later.
Services with usable free tiers include Formspree, Web3Forms, Basin and Getform. Setup is a few minutes: create the endpoint, copy the URL, paste it into the "Send submissions to" field in the form generator. Most also offer spam filtering, auto-reply emails to the person who submitted, and captcha support on paid tiers — the things a small business actually ends up wanting.
If your site already runs on a server you control (PHP hosting, Node, anything server-side), you can receive the form yourself: a small script that reads the POST fields, emails them to you or writes them to a database, and shows a thank-you page. This gives you full ownership of the data and no third party — at the cost of writing and maintaining that script, including its spam handling.
Setting the action to mailto:you@business.com looks like
the obvious shortcut. Don't. It doesn't send anything by itself — it tries
to open the visitor's email app with the data pasted in. On computers
without a configured mail app (most of them, these days) the form just
silently does nothing, and you'll never know how many customers you lost
to it.
Any public form gets found by bots eventually. Two layers, in order:
Form submissions are personal data. If EU residents can submit your form, GDPR expects you to say near the form what the data is used for, ask only for what you need, and delete what you no longer use. For a small business contact form, a single line under the form ("We use your details only to reply to your message") covers the common case.
Not by itself — plain HTML can't send email. A mailto:
action only opens the visitor's own email app, which fails silently for
many people. Use a free form backend service instead: it receives the
submission and emails it to you.
A service that gives you a URL to put in your form's action attribute. When someone submits the form, the service receives the data, emails it to you, and usually stores it so you can download your leads later. Several offer free tiers.
Start with a honeypot field — an invisible input that catches naive bots. If real spam gets through, add a captcha like Cloudflare Turnstile or hCaptcha. Captchas must be verified server-side, so they're configured at your endpoint or form backend, not in the HTML alone.
Yes, but if you collect personal data from EU residents, GDPR applies: say what you'll use the data for near the form, only ask for what you need, and delete data you no longer use. A one-line privacy note under the form covers most small-business cases.
The hform/forms generator gives you clean, accessible form HTML with a honeypot included — just add the action URL from whichever option you chose above.