Platform Guide

Ghost Contact Form

Add a contact form that emails you to a Ghost site with an HTML card

Last updated November 5, 2026

To add a contact form to a Ghost site, paste one HTML form into an HTML card on a page and add a thank-you page. The form posts to https://api.staticforms.dev/submit with your form's API key, and Static Forms emails each submission to you. You do not edit your theme, the form uses no script, and it works on the Static Forms free plan. Ghost's own signup form is for members; this form is for private messages.

1. Copy the form

Replace YOUR_API_KEY with the key from the General tab of your form in the app, and YOUR-SITE.com with your site address. The key is visible in the page, which is expected: the form API key cannot read submissions.

HTML card

The visitor's email field becomes the reply-to address on the notification, and every other named field appears in the email. redirectTo must be a full URL. Without it, the visitor sees a plain confirmation from Static Forms instead of your own page.

2. Add it to a page

Ghost's editor cards guide says HTML cards are useful for embedding external content such as forms, and that you add the card and paste or write your code. It lists no plan requirement for the HTML card. You can open the card menu with the + button, or type / on a new line and search for the card.

Create a Contact page

In Ghost Admin, create a new page (not a post) titled Contact.

Add an HTML card

Type /html on a new line, choose the HTML card and paste the form into it.

Create the thank-you page

Create a second page titled Thanks with a short message, and use its full published address as the redirectTo value. The address Ghost gives the page may differ from the one shown here, so copy it from the published page.

Publish both and test

Publish both pages, then add the Contact page to your navigation if you want a link to it.

We have not tested the form inside a live Ghost site, and Ghost's card guide does not describe how it treats form markup, so send a test message from the published page.

3. Test it

Send a message from the published page and check that you land on the thank-you page. The message arrives by email and is listed in the Inbox in the app.

Spam protection

Every submission goes through the built-in spam filter, and the honeypot field catches bots that fill in every field. CAPTCHA widgets and their field names are in the plain HTML guide. A longer walkthrough is in the Ghost contact form tutorial.

Domain restriction

If you turn on domain restriction (Starter and up), add your site domain. A domain that is not on the list is rejected with a 403 that names it.

Troubleshooting

What you see	Why, and what to do
401 "Invalid API key"	Check that the apiKey value matches the key on the form's General tab, with no extra spaces.
The visitor sees a plain confirmation, not your page	The redirectTo value is missing or is not a full URL.
The form is not visible to some visitors	HTML cards have a visibility setting (the eye icon in the card toolbar). Check that it is set for public visitors.
A field is missing from the email	Give the input a name attribute.
403 "Submission rejected: Domain … is not in the allowed domains list"	Domain restriction is on and your site is not listed. Add your domain on the form's security settings.
No email arrives	Check your spam folder, then the Inbox in the app: if the submission is listed, the problem is delivery.

FAQ

Does this work on the free plan?

Yes. The snippet only uses Free plan features: 250 submissions every 30 days, 1 form endpoint, email delivery, the built-in spam filter, a honeypot field and reCAPTCHA v2. No credit card is needed.

How do I keep spam out?

Every submission is checked by the built-in spam filter on every plan. The snippet adds a hidden honeypot field (any field whose name contains "honeypot"); bots fill it in and those submissions are dropped. reCAPTCHA v2 is available on Free. Cloudflare Turnstile, hCaptcha, ALTCHA and reCAPTCHA v3 are available from the Starter plan.