A free form action URL for any HTML form.

It is the value of a form's action attribute: the address that receives the submitted data. splitforms gives you one, https://splitforms.com/api/submit, so the form works without a server of your own. Keep method="POST" and add a hidden access_key input.

Use POST. GET puts form fields into the URL query string and is appropriate for search and filters. POST sends fields in the request body and is the correct method attribute for contact forms, lead forms, file uploads, and anything that creates a record.

Yes. A normal browser form submit can POST to an absolute URL on another domain, including https://splitforms.com/api/submit. CORS only becomes a concern when you intercept the submit with JavaScript and use fetch or XMLHttpRequest instead of a native form POST. If you do submit with fetch, the splitforms endpoint answers with Access-Control-Allow-Origin: * and handles the OPTIONS preflight.

Use a form-backend endpoint like https://splitforms.com/api/submit. Add your access key as a hidden field, keep method set to POST, and submissions are stored in a dashboard, emailed to you for free on every plan, and filtered for spam automatically.

Yes. Point action at https://splitforms.com/api/submit instead of a mailto: link, which only works when the visitor has an email app set up. splitforms sends the owner notification email on every plan, including Free, with no server or SMTP setup.

The enctype attribute controls how the browser encodes the request body. The default, application/x-www-form-urlencoded, works for text fields. Add enctype="multipart/form-data" when the form includes an <input type="file">, such as a resume or attachment upload — splitforms supports multipart submissions and, on paid plans with the Storage integration, stores up to 5 files per submission at 5 MB each.

Add a hidden field named redirect, for example <input type="hidden" name="redirect" value="/thank-you" />. After a classic HTML POST, splitforms answers with a 303 redirect to it, on every plan and with no JavaScript. The value can be a path starting with /, or an absolute http(s) URL on your form's allowed-domains list, on splitforms.com, or (when no allow-list is set) the site the form was submitted from. Anything else is ignored: the visitor goes to the redirect URL set in Form settings if there is one, otherwise to the default thank-you page. A Form settings redirect URL works on every plan, and the hidden field takes priority over it.

Yes. splitforms recognizes a few special hidden fields alongside access_key: subject sets the notification email's subject line, and replyto sets the address you can reply straight to. Both are optional and read from the same POST your form action already sends.

No — spam protection travels with the endpoint, not the markup around it. splitforms checks the botcheck honeypot, applies a time trap when the form sends a form_loaded_at field, scores content server-side, and rate-limits each visitor IP on each form (6 a minute, 20 per 15 minutes), however the surrounding page is built.