Formpit blog
Notes on forms, spam and running a small SaaS
Practical guides for anyone who has a form on their website, plus honest build-in-public notes from making Formpit.
How to Add a Contact Form to a Static Website (No Backend Needed)
Four ways to add a working contact form to a static site, with copy-paste HTML, a JavaScript version, spam protection, privacy notes and a testing checklist.
SpamHow to Stop Contact Form Spam Without a CAPTCHA
A layered approach to contact form spam: honeypots done right, time traps, content checks, rate limits and when a CAPTCHA is actually worth it. With code.
DebuggingHTML Form Not Working? 11 Common Mistakes and How to Fix Them
Missing name attributes, GET instead of POST, files without multipart, FormData headers, CORS and more: the form bugs that cause most broken contact forms, and their fixes.
WebhooksHow to Verify Webhook Signatures in Node.js (HMAC-SHA256, Done Right)
Verify webhook signatures safely in Node.js: use the raw body, compare in constant time, reject replays with timestamps and handle duplicates. Express and Next.js examples.
Build in publicRunning a SaaS on One SQLite File: Fly.io and Litestream in Production
How Formpit runs on a single SQLite file on Fly.io with Litestream streaming backups to Cloudflare R2: the setup, the gotchas, restoring, and when this approach stops working.