Want the hands-on version? Read the docs.
See exactly how these pieces — spam protection, SMTP, autoresponders — work inside FormBridge.
Short, accurate definitions for the terms you run into when wiring up forms, email delivery, and spam protection.
A form endpoint is the URL a form's data is sent to on submit — the value of the form's action attribute. A headless form backend like FormBridge gives you a ready-made endpoint (e.g. https://app.formbridge.ai/api/forms/fb_8h2k9p) so you don't have to write and host that URL's server logic yourself.
A headless form backend handles submissions — receiving them, checking for spam, sending notifications — without providing any front-end UI of its own. You keep full control over how the form looks and behaves; the backend only takes over once the browser submits the data.
The action attribute on an HTML <form> element specifies where the browser sends the form's data on submit. <form action="https://app.formbridge.ai/api/forms/fb_8h2k9p" method="POST"> is enough to connect a plain HTML form to a hosted backend — no JavaScript required.
A webhook is an HTTP callback: when an event happens (like a form submission), the service sends a request — usually a JSON payload via POST — to a URL you specify, so your own systems can react in real time instead of polling for changes.
Note: webhooks are on FormBridge's roadmap and marked "Coming soon" — not available on any plan yet. See the roadmap.
POST sends form data in the request body and is the correct method for anything that creates or changes data, like a submission — it also has no practical limit on how much data you can send. GET appends data to the URL as a query string, meant for requests that only retrieve data; using it for a submission exposes the data in the URL and browser history. Most form backends, including FormBridge, expect POST.
This is the enctype a form needs when it includes file uploads, alongside method="POST". It splits the submission into separate parts so binary file content can be sent safely next to regular text fields in the same request.
SMTP (Simple Mail Transfer Protocol) is the protocol used to send email from one mail server to another. When a form backend sends a notification or autoresponder email, it does so over SMTP — either through the backend's own default sender, or through your own SMTP account (Gmail, Postmark, Resend, Mailgun, SES, and similar) if you want the email to come from your own domain.
Three DNS-based email authentication records that tell receiving mail servers whether an email claiming to be from your domain is legitimate. SPF lists which servers may send mail for your domain. DKIM attaches a cryptographic signature to outgoing mail so it can be verified in transit. DMARC tells receivers what to do if SPF or DKIM checks fail, layered on top of both.
Getting all three right on your sending domain is what keeps notification and autoresponder emails out of spam folders.
A honeypot is a form field hidden from human visitors with CSS but still present in the HTML, so bots that auto-fill every field on a page end up filling it in too. Any submission that arrives with the honeypot field filled in is silently treated as spam, since a real visitor never sees or fills it.
Cross-Site Request Forgery is an attack where a malicious site tricks a logged-in user's browser into submitting a request to a different site the user didn't intend — for example, silently posting a form on their behalf. It matters most for forms that change account state while a user is authenticated; a stateless public endpoint that just accepts submissions, like a contact form, is a smaller target, but authenticated actions should still use CSRF tokens or same-site cookie protections.
An automatic email sent back to whoever just submitted a form, typically confirming their message was received. It's usually configured with its own subject and body — which can reference the submitted field values, e.g. "Dear {{Full-Name}}" — and its own sender branding, separate from the notification email your team receives.
A two-step signup process where, after someone submits an email address, they must click a confirmation link sent to that address before they're actually added to a list. It protects against typos, fake addresses, and bots, at the cost of a small drop-off between submission and confirmation.
Cross-Origin Resource Sharing is a browser mechanism that decides whether JavaScript on one origin (e.g. your site) can read the response of a request made to a different origin (e.g. a form API). A plain HTML <form> POST doesn't need CORS at all, since the browser navigates directly to handle it. CORS only matters if you submit the form with fetch/XHR and need to read the JSON response back in your own page.
Rate limiting caps how many requests a client — by IP, API key, or similar — can make in a given time window, so a form endpoint isn't overwhelmed by a scripted flood of submissions. It complements spam scoring and CAPTCHA: where those judge whether a submission looks human, rate limiting simply stops volume regardless of intent.
See exactly how these pieces — spam protection, SMTP, autoresponders — work inside FormBridge.