How Form2Lead Works
Understand the request pipeline from frontend HTML submit to verified lead delivery.
How Form2Lead Works in 4 Steps
Zero complex backend configuration. Keep your website frontend completely static while receiving verified customer leads.
Create Form Endpoint
Generate a unique submission endpoint URL in seconds from your Form2Lead dashboard.
Connect Existing Form
Paste your endpoint URL into your HTML action attribute or JavaScript fetch handler.
Automatic Spam Check
Incoming payloads pass through honeypot detection and CORS origin locking automatically.
Receive Clean Leads
Get structured email alerts via email and access submissions in your lead dashboard.
Zero SDK Dependencies.
Standard HTML & Fetch.
Form2Lead works natively with any standard HTML5 form, React component, static site generator, or JavaScript fetch call.
- ✔No client-side JavaScript bundle required for HTML forms
- ✔Built-in honeypot spam protection using
_gotcha - ✔JSON response format support for AJAX submissions
<form action="https://form2lead.com/api/v1/f/abc123xyz" method="POST"> <label for="name">Name</label> <input type="text" id="name" name="name" required /> <label for="email">Email</label> <input type="email" id="email" name="email" required /> <!-- Hidden Honeypot Field for Spam Protection --> <input type="text" name="_gotcha" style="display:none !important" tabindex="-1" autocomplete="off" /> <button type="submit">Submit Lead</button> </form>
The Submission Pipeline, Step by Step
The summary cards above show the flow at a glance. Here is exactly what happens between the moment a visitor clicks Submit and the moment the lead reaches you — five steps, all handled server-side, with nothing to configure on your host.
Your form posts to your Form2Lead endpoint
Every form you create gets a unique submission URL — POST https://form2lead.com/api/v1/f/{publicKey}. Set it as your form’s action attribute or fetch() target and keep the rest of your HTML untouched. No SDK, no npm package, and no server code required: plain HTML forms, React, Astro, Webflow, or anything else that can send a POST.
Form2Lead verifies the request origin
The API checks the request’s Origin header against the form’s Allowed Domains list before doing anything else. Submissions from domains you never approved are rejected outright, which blocks attackers who scrape your action URL and replay it from their own sites. This CORS domain lock is on by default for every form.
Spam scoring: honeypot + IP rate limiting
Next the payload passes spam checks: an invisible honeypot field that bots fill automatically and humans never see, plus per-IP rate limiting that throttles scripted floods from a single address. Both run server-side with zero user interaction — Form2Lead never shows a CAPTCHA, so no legitimate visitor is ever challenged.
Validation and persistence
Valid submissions are stored as lead records in your searchable dashboard, with every payload key captured — name, email, message, and any custom field you added. Retention follows your plan (14 days on Basic, 30 on Starter, 120 on Growth), and you can export any submission set to CSV at any time.
Delivery: email notification + dashboard + optional webhook
The moment a submission is stored, Form2Lead sends an instant email notification with the lead’s contents to your configured recipients. If you’ve set up a webhook, the JSON payload is also fanned out to your endpoint with an HMAC signature and automatic retries, and the analytics view logs the submission for reporting.
What Happens to Your Data
A stored submission belongs to your account only: it appears in your searchable dashboard, counts against your plan’s monthly quota, and lives for your plan’s retention window — 14 days on Basic, 30 days on Starter, and 120 days on Growth. From the dashboard you can search every payload key, delete individual records, or export the full set to CSV — there is no data lock-in. If you stream submissions to your own systems, webhooks sign every payload with an HMAC signature and retry failed deliveries automatically. Form2Lead is paid-only — there is no free plan that monetises your data — and you can create an account and test the full pipeline before you pay.
What happens when a user submits your website form?
When a visitor clicks Submit, the browser posts form payload data directly to your Form2Lead endpoint. Form2Lead validates the CORS domain origin, checks for honeypot spam fields, stores the lead record, and dispatches instant email alerts via email.
How It Works: FAQ
Do I need to write any backend code to use Form2Lead?
No. Form2Lead replaces the backend entirely — you point your form’s action attribute (or fetch handler) at your Form2Lead endpoint and the API handles origin checks, spam scoring, storage, and email delivery. Your site stays fully static.
Does Form2Lead ever show a CAPTCHA to my visitors?
Never. Spam protection is invisible by design: a hidden honeypot field plus server-side IP rate limiting. Real visitors just click Submit — there is no puzzle, no third-party widget, and no JavaScript requirement.
What if an email notification fails to arrive?
Delivery by email is one channel, not the source of truth. Every accepted submission is persisted in your dashboard immediately, so a missed email never means a lost lead — search the dashboard or pull the record via CSV export.
You Are Never Stuck On Your Own
Form2Lead ships with a built-in support desk on every plan. When something needs a human, you get one — no extra add-on, no premium tier required.
In-app threaded conversations
Hit a problem with an endpoint, a domain rule, or your plan? Open a ticket in seconds and chat directly in an interactive thread right inside your dashboard.
Real-time engineer sync
Every ticket syncs instantly to our on-call engineering team in real time. Direct answers from the engineers who built the platform in minutes, not days.
Complete status transparency
Follow tickets from Open to Resolved in your dashboard. Full conversation history is preserved forever with real-time updates when staff responds.