FAQ

Do I need JavaScript?

No. A plain HTML form with action="https://api.w3forms.com/submit" and method="POST" works out of the box. The browser handles the POST and W3Forms redirects to your success page. If you want JSON responses for custom UI states (loading spinners, inline success messages), use fetch with the Accept: application/json header instead.

Where do I find my access key?

Create a form in the W3Forms dashboard and copy the access key. The key is shown once at creation — save it somewhere safe. Access keys are hashed with SHA-256 before storage, so we cannot recover a lost key. If you lose it, delete the form and create a new one.

Why am I getting blocked on production but not locally?

Check Allowed Domains in Form → Settings. Your production domain (e.g., yoursite.com) must be listed. Localhost is allowed by default during development but production domains need explicit approval. Also verify that any redirect URLs match your allowed domains or use relative paths.

How do I verify webhook requests?

Use the X-W3Forms-Signature header and your webhook secret to compute HMAC-SHA256 over the raw request body, then compare the result with the header value using constant-time comparison. See the Webhooks docs for full code examples in Node.js and Python.

See Webhooks for full code examples.

What are the plan limits?

Free: 250 submissions/month with 1 form. Pro ($9/month): 10,000 submissions with 50 forms, plus webhooks, file uploads, and custom redirects. Business ($29/month): 50,000 submissions with unlimited forms, dedicated support, and API access. All plans include spam protection and email notifications. No credit card is required for the free tier.

See Pricing for a full comparison.

What happens when I hit my submission limit?

New submissions are rejected with a 400 error until your next monthly billing cycle. Your existing submissions remain accessible in the dashboard. You can upgrade your plan at any time to increase the limit immediately. Spam submissions do count toward your monthly quota.

Does W3Forms store my form data?

Yes. All submissions are stored in encrypted PostgreSQL databases and available in your dashboard. You can view, search, and export submissions at any time. When you delete a submission or your account, the data is permanently removed within 30 days. See our Privacy Policy for full details on data handling.

Is W3Forms GDPR compliant?

W3Forms acts as a data processor on your behalf. We store submission data securely, do not sell or share it with third parties, and support data access, rectification, and deletion requests. You are responsible for obtaining proper consent from your form visitors and including appropriate privacy disclosures on your website.

See our Privacy Policy for full details.

What frameworks does W3Forms work with?

Any framework that renders HTML. W3Forms has been tested with React, Next.js, Astro, Vue, Svelte, Hugo, Gatsby, Webflow, WordPress, and plain HTML. There is no SDK or client library required — just point your form action at our API endpoint. It works with any hosting provider including Vercel, Netlify, Cloudflare Pages, GitHub Pages, and S3.

Can I upload files through forms?

Yes, on Pro and Business plans. Set enctype="multipart/form-data" on your form and add file input fields. Files are stored securely and linked to the submission in your dashboard. Check your plan for size and count limits.

How does spam protection work?

W3Forms offers multiple layers of spam protection. The honeypot field is an invisible input that catches bots (no user friction). The keyword blacklist rejects submissions containing specific words you define. Disposable email blocking rejects known throwaway email domains. You can also enable captcha for higher-risk forms. Spam submissions are stored in your dashboard (marked as spam) but do not trigger email notifications or webhooks.

Learn more in Customization.

Can I customize the email notification?

Yes. In Form → Settings you can configure the recipient email, CC addresses, subject line (with placeholders like {{name}} for form fields), and reply-to address. Setting reply-to to the submitter's email lets you reply directly from your inbox. You can also enable auto-response emails to send a confirmation to the person who submitted the form.

What is the difference between redirect and JSON response?

By default, a browser form POST redirects to your configured success URL (or a default W3Forms page). If you send the Accept: application/json header — typically via fetch or XMLHttpRequest — you get a JSON response with a success flag and message. Use redirects for traditional multi-page forms and JSON for single-page applications where you control the UI.

How do I migrate from another form service?

Migrating to W3Forms takes about two minutes. Create a form in the dashboard, copy your access key, and change your form's action URL to https://api.w3forms.com/submit. Add the access_key hidden field. If you were using Netlify Forms, remove the netlify attribute. If you were using Formspree, just swap the action URL. Your existing form fields work as-is — no schema changes needed.

See the Quick Start for a complete setup walkthrough.

Is there an API for managing forms programmatically?

Forms, submissions, and settings are managed through the dashboard and its authenticated API. The public API endpoint (POST /submit) is for receiving form submissions from your website visitors. The dashboard API uses JWT authentication and supports creating forms, managing access keys, configuring webhooks, and exporting submissions.