A static site has no server. A form needs one thing that runs.

1. 1

   The fields on the page

   What you ask a visitor to fill in. A briefed change adds, removes, or renames a field — it is your form to design.

   Owned by You
2. 2

   The endpoint that catches the POST

   A small managed endpoint that receives the submission. A static site has no server of its own to catch it — this is the one thing a static plan needs briefed in.

   Owned by CustomHosted
3. 3

   The destination the submission lands in

   An inbox, a database row, a file, or an outside service. The endpoint decides where a submission goes; see where a submission can end up below.

   Owned by You

1. 1

   A visitor submits the form

   You

   The browser sends the fields to the endpoint. Nothing here holds a secret — see the four things a form must not do below.

2. 2

   The endpoint checks the request

   CustomHosted

   Method, field length, and a hidden field a human never fills in. This site's own defences are the worked artifact below.

3. 3

   The endpoint writes to the destination

   CustomHosted

   A message handed to the mail relay, a row written to a database, or a file saved to storage, depending what the form is for.

4. 4

   The relay takes it from there

   CustomHosted

   Once a message reaches the relay, Email owns the rest of the hop: delivery, signing, and bounces.

• No secret in the page

  Every file shipped to a visitor's browser can be read by that visitor. A value baked in at build time is public the moment it ships — not hidden, only unlabelled. A form on a static page can hold no secret value — see Configuration for the full rule.

• No mailto: link as a form

  A mailto link opens the visitor's own mail app, if they have one configured, and shows your address in the page source either way. It is not a form.

• No unbounded field

  Every field needs a hard length limit, or a message field becomes a place to paste anything at all. See the field caps in the worked artifact below.

• No trust in the browser's own validation

  A required attribute in the page's markup stops a normal visitor, not a script posting straight to the endpoint. The endpoint has to check again.

• An inbox someone already reads

  The common case — a submission arrives as mail, sent onward through the relay. See Email.

• A database row

  A submission saved for later, queried instead of read one message at a time. See Databases.

• An outside service

  A support desk, a CRM, a spreadsheet tool — anywhere a submission can be handed off to over its own API. See Outside services.

• A file

  An attachment saved to storage rather than a database. A static site has no writable disk, so a static plan alone has nowhere to put one. See Files.

This site's own form posts with JavaScript. With JavaScript off, this site's own quote form does nothing at all when the button is pressed. A form that also posts without JavaScript is quoted work, briefed like any other change — not a setting to switch on.

• This page's own quote form runs on the exact shape above: a static site, with a briefed endpoint behind it.
• A configuration handed off from the estimator or the selector fills a spec plate on the form. A visitor never retypes what they already chose.
• A composed change brief fills the message field the same way. A visitor arrives with a ready-to-send request, not a blank box. See Brief a change.

• A static plan plus a briefed endpoint

  Static Starter or Static Pro, plus the endpoint briefed once as a change. No separate line item for the endpoint itself.

• A form does not push you onto dedicated compute

  Static hosting starts at $5/mo. Dedicated compute starts at $29/mo. A form on a static plan is the cheaper shape because it adds an endpoint, not a server.

• No per-submission meter

  A form does not bill by the message. Ten submissions a month or ten thousand cost the same, up to the fair-use transfer allowance the plan already carries.

• Agentic iteration — CodeHerder

  $25/mo. Changing a field, adding a destination, or tightening a check later is a briefed change, not a new project. Quoted flat within one business day if the first brief itself needs pricing.

• The endpoint refuses the request

  Owner: Ours

  A required field is missing, the address is malformed, or the method is wrong. The endpoint answers with an error and sends nothing. An over-long field is not one of these cases — see the caps in the worked artifact above.

• Refused by the relay

  Owner: Ours

  The relay itself rejects the request before the message goes anywhere — a configuration problem on the sending side.

• It bounces once delivered

  Owner: Your data

  The destination address no longer exists. See Email for the rest of that failure mode.

• Nobody reads the destination

  Owner: You

  The submission arrived. Nobody reads the inbox, spreadsheet, or database any more. Monitoring watches whether the endpoint itself is up — not whether a human reads what lands.

• No drag-and-drop form builder

  A field, a destination, or a check is a briefed change to the endpoint's own code, not a setting in a dashboard.

• This site's own form posts with JavaScript

  With JavaScript off, this site's own quote form does nothing at all when the button is pressed. A form that also posts without JavaScript is quoted work, briefed like any other change — not a setting to switch on.

• Deliverability is never guaranteed

  Whether a message lands in an inbox, a spam folder, or nowhere at all depends on the receiving side's own filtering and your own sending reputation. Inbox placement is not something measurable from here, and nobody can promise it. See Email for the full deliverability picture once a submission is handed to the relay.

• No file upload by default

  A field that accepts an attachment is real work we can build — quoted flat, the same as any other custom infrastructure request, not something switched on by asking.