Form Backend Service for Static Sites with Spam Filtering

The problem static sites have with forms

Portfolios, small business sites, event pages and landing pages are increasingly built as static sites or on no-code builders. They still need a contact or registration form, but there is no server to receive it. Owners paste in a hosted form, which looks out of place, or a third-party endpoint whose free tier runs out. The bigger pain is spam: within days of launch, the inbox fills with bot submissions, and owners either disable the form or miss real enquiries.

What already exists and the gap

• Formspree is a long-standing form backend with email notifications and integrations.
• Web3Forms offers a generous free tier aimed at hobby and low-budget sites.
• Basin focuses on simplicity and spam prevention and includes webhooks on its free plan.
• Getform, now rebranded as Forminit, stores submissions, sends notifications and supports file uploads.

This is a crowded market, which is fine for an FYP: it shows real demand and gives you clear benchmarks. The gap you can realistically fill is transparency and regional fit: an open source, self-hostable backend with explainable spam decisions (why was this blocked?), pricing that works in local currency, and documentation written for the static site generators and builders students and small agencies actually use.

What you build

Users: site owners (create forms, read submissions), developers or agencies (manage many client forms), and visitors who submit forms.

Flow: an owner creates a form and copies the snippet. A visitor submits. The service checks the honeypot, rate limits and optional Turnstile token, scores the submission, stores it in the inbox or spam folder, emails the owner and fires any webhooks. The owner can correct spam decisions, which are logged as labels for later improvement.

The technically interesting part

Spam filtering you can explain and measure. Combine cheap signals (honeypot filled, submission too fast after page load, too many links, known disposable email domains, repeated content, rate) into a score, and store the reasons with every decision. Build a labelled test set from real submissions to your own forms and a public spam corpus, then measure precision and recall. Tune thresholds and show the trade-off: blocking more spam versus losing real messages.

Abuse-resistant public endpoint. The endpoint is open to the internet by design. Enforce body size limits, per-IP and per-form rate limits, origin checks where configured, and safe handling of HTML in submissions so the dashboard cannot be attacked with injected scripts. Sign webhook payloads with HMAC, as Stripe and GitHub do, and document how receivers verify them.

How to evaluate it

• Spam accuracy: precision and recall on a labelled set of at least 500 submissions, with a confusion matrix and the threshold you chose.
• Latency: 95th percentile response time for a submission under a load of 50 requests per second with k6.
• Security checks: show that stored script injections are rendered harmlessly and that rate limits hold under a scripted flood.
• Adoption: get at least 5 real sites (friends, societies, local businesses) using it for a month and report submissions, spam blocked and false positives.

Suggested plan

1. Weeks 1 to 2: sign up to two existing services, note what works and what annoys you.
2. Weeks 3 to 6: accounts, forms, submission endpoint, storage, email.
3. Weeks 7 to 9: spam defences and reason logging, dashboard.
4. Weeks 10 to 12: webhooks with signatures, CSV export, docs.
5. Weeks 13 to 15: labelled evaluation, load test, adoption report.

Path to a product

Your first customers are student societies, freelance web designers and small agencies who build sites for local businesses and need forms for every client. Offer a free tier by submission count and a paid tier for agencies with many forms. Open sourcing the core and selling hosting is a credible model in this space.

Scope warning

Do not build a drag and drop form builder, surveys with logic, payments or a CRM. Do not train a deep model before the rule-based score is measured. Keep the dashboard small and fast.

Learn what you need on Sefism

• Backend roadmap : HTTP servers, databases and background jobs for a first real service.
• Backend cheat sheet : quick reference for routes, validation and rate limiting.
• MDN: HTTP : form encodings, CORS and redirects you will handle daily.
• Webhook.site : inspect your outgoing webhooks while you build them.
• OWASP ASVS : a checklist for a public endpoint that anyone can hit.

Get help with this idea

The spam evaluation is what turns this from a tutorial into a strong project. Tauseef can help you tighten the scope, choose a stack your team can finish with, and design an evaluation your examiners will respect. If you are new here, create a free account first.

• Discuss this idea with a mentor
• Send a query to Tauseef
• Book a 1:1 session