The One-Page Form Security Checklist - splitforms.com

1.

The One-Page Form Security Checklist
Print it, pin it up, and work through it before any form goes live.
A contact form is a public door into your inbox. Anyone, and anything, can push data through it. The
checklist below covers the points worth checking on every site, and shows how a hosted backend like
splitforms takes care of several of them for you.
1. Transport and destination
☐ Make sure the form posts over HTTPS. The splitforms endpoint is
.
☐ Use method="POST" so submitted data never ends up in URLs or server logs.
☐ Check that the action URL actually responds. splitforms has a free form action URL tester
that checks reachability, status, CORS headers and POST support.
https://splitforms.com/api/submit
2. Bot and abuse defenses
☐ Honeypot: add a hidden field that humans leave empty. splitforms rejects submissions with a
filled honeypot before storing them.
☐ Time-trap: implausibly fast submissions are rejected too.
☐ Rate limits: per-IP limits slow down floods.
☐ Content scoring: suspicious messages are quarantined, not deleted.
☐ Review queue: check the Spam folder now and then so real messages aren't lost.
☐ CAPTCHA: only add one if you need it. With splitforms, reCAPTCHA or Turnstile is optional
and nothing is shown unless you turn it on.
3. Input hygiene
☐ Mark essential fields required.
☐ Use the right input types (type="email") so browsers validate before sending.
☐ Collect only what you need. Every field you add is more data you're responsible for.
4. Storage and privacy
☐ Find out where submissions are stored and who can read them. splitforms keeps them in
Postgres with row-level security, and staff access is limited to support and abuse prevention.

2.

☐ Confirm your data isn't sold or used to train models. splitforms states it does neither.
☐ If you serve EU visitors, get a Data Processing Agreement. splitforms provides one.
5. Downstream delivery
☐ If you forward submissions to your own server, verify the webhook signatures. splitforms
signs webhooks with HMAC-SHA256 (paid plans).
☐ Plan for retries. splitforms retries once, after about 2 seconds, on timeouts and 5xx errors.
6. File uploads
☐ Cap the number and size of uploads. splitforms allows up to 5 files of 5 MB each per
submission, on paid plans with Storage connected.
7. Operations
☐ Bookmark the provider's status page.
☐ Know what happens when you hit your quota. On the splitforms Free plan, extra submissions
get an HTTP 429 response, and stored data stays put.
Ticked everything? Get a free access key (500 submissions, no card) from the Split Forms hosted
form backend.