GitHub Pages Contact Form
Add a working form to a GitHub Pages site with no server code
GitHub Pages only serves static files, so a form has nowhere to post to. To add a contact form without a backend, paste the form below into any page of your repository (for example contact.html), replace YOUR_API_KEY with the key from your Static Forms dashboard, and push. The form posts straight to https://api.staticforms.dev/submit and each submission arrives in your inbox. It needs no build step, GitHub Action or Jekyll plugin, and it works on the free plan.
redirectTo is optional and must be a full URL; without it the visitor sees a plain confirmation. Project sites live under https://USERNAME.github.io/REPO/; user and organization sites (a repository named USERNAME.github.io) live at https://USERNAME.github.io/. Every submission goes through the built-in spam filter, and the honeypot field catches simple bots. If your site uses Jekyll, the Jekyll guide shows how to turn this into a reusable include.
API Key in Code
GitHub Pages has no environment variables at runtime, so the API key goes directly in your HTML, as above.
Public Repository
The key is visible in your published HTML whether the repository is public or private. That is expected: the key cannot read your submissions or sign in to your dashboard. If you prefer to keep it out of the repository, inject it at build time with GitHub Actions.
Using GitHub Actions
For better security, use GitHub Actions to inject the API key during build:
FAQ
Does this work on the free plan?
Yes. The snippet only uses Free plan features: 250 submissions every 30 days, 1 form endpoint, email delivery, the built-in spam filter, a honeypot field and reCAPTCHA v2. No credit card is needed.
How do I keep spam out?
Every submission is checked by the built-in spam filter on every plan. The snippet adds a hidden honeypot field (any field whose name contains "honeypot"); bots fill it in and those submissions are dropped. reCAPTCHA v2 is available on Free. Cloudflare Turnstile, hCaptcha, ALTCHA and reCAPTCHA v3 are available from the Starter plan.
Is it safe to put the API key in my HTML?
Yes. The form API key is meant to be public. It cannot read your submissions or sign in to your dashboard. From the Starter plan you can also restrict submissions to your own domains.
Why doesn't my form work on GitHub Pages without a form backend?
GitHub Pages serves static files and has no server to receive a POST request, so a form needs an external endpoint. Pointing the form action at https://api.staticforms.dev/submit gives it one.
