html.contact looks like one form action. A site sends a normal HTML form to a hosted endpoint. That is the easy part.
The endpoint has to accept real visitors without becoming a free spam relay. It checks the form key, allowed domains, field limits, bot traps, message patterns, request volume, and account usage. Browser headers can help screen abuse, but they do not prove where a request came from.
Rejected spam does not count toward a customer’s normal submission volume. Charging for junk aimed at a public endpoint would be absurd.
When a submission is accepted, html.contact writes the durable record before email work finishes. Attachment bytes go to private object storage. The database keeps the submission, usage, attachment metadata, and a safe activity record.
Email is a notification, not the only copy of a lead. If it fails halfway through, a scheduled job can finish it later. An idempotency key lets a safe retry return the original result instead of creating a second lead.
Recipients live inside the account and get verified there. A public form field never decides where mail goes. That one boundary keeps a contact form from becoming an open sender.
html.contact receives a normal form, screens it, stores it, and sends it to the right inbox. It does not need to become a CRM to do that well.
Create your first form on html.contact.
Read why html.contact is the best form endpoint for focused sites.