Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Web Security TippsAssign temporary administrator roles in the Google Admin console(23.09.2026 um 23:23 Uhr)
Sichere ProgrammierungIs GEO only in our heads, or something real?(24.09.2026 um 01:43 Uhr)
Sichere ProgrammierungScoped Permission Error in One Code Branch (Capability Evidence First)(24.09.2026 um 01:48 Uhr)
Web Security TippsAssign temporary administrator roles in the Google Admin console(23.09.2026 um 23:23 Uhr)
Sichere ProgrammierungIs GEO only in our heads, or something real?(24.09.2026 um 01:43 Uhr)
Sichere ProgrammierungScoped Permission Error in One Code Branch (Capability Evidence First)(24.09.2026 um 01:48 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

How to add a contact form to your static site — no backend, no monthly fee

I got tired of paying for form services or spinning up a backend just to handle contact form submissions. So I built RG Forms — a contact form endpoint backed entirely by a Google Sheet you own. No server, no monthly fee, no third-party s…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

I got tired of paying for form services or spinning up a backend just to handle contact form submissions. So I built RG Forms — a contact form endpoint backed entirely by a Google Sheet you own. No server, no monthly fee, no third-party storing your data.






The idea



Most form tools store your submissions on their servers. You pay monthly, you depend on their uptime, and your data lives in their database. RG Forms does the opposite: every submission goes straight into a Google Sheet in your own Google Drive, sent by an Apps Script that you own and control.



RG Forms provisions that sheet and script for you in about 90 seconds. After that, your endpoint runs forever at no cost — completely independent of any RG Forms server.






Built for static sites



If you host on GitHub Pages, Netlify, Vercel, Cloudflare Pages, or just plain HTML on a CDN, you've hit this wall: there's no backend to receive a form POST. The usual workarounds are a paid form service, a serverless function you have to write and maintain, or standing up a whole backend just for a contact form.



RG Forms is built exactly for this. Your endpoint is a plain HTTPS URL you POST to straight from client-side JavaScript — no build step, no serverless function, no server of any kind. Drop the fetch call into your page and you're done. It pairs naturally with any static-site generator (Hugo, Jekyll, Astro, Eleventy, Next export) and any no-code builder that lets you add a snippet of JS. Your static site stays static; the form just works.






How it's built



RG Forms is a fully static web app. There's no RG Forms server, no database, no backend. Every API call during setup goes directly from your browser to Google using your own OAuth token.




Setup (one time, in your browser):

Your Browser
├─── Google OAuth ──▶ Short-lived token (memory only)
├─── Google Drive API ──▶ Creates Sheet + Drive folder
└─── Apps Script API ──▶ Creates & deploys form handler

Live endpoint (after provisioning):

Your Website / App
└─── POST to script URL
└─── Apps Script (in your Google account)
├─── Appends row to Google Sheet
├─── Sends email notification
└─── Returns { result: "success" }






That OAuth token lives only in browser memory — never sent to an RG Forms server, never written to disk, gone when you close the tab.






What gets created in your Drive




  • A Drive folder named after your form

  • A Google Sheet with your column headers, plus a hidden _manifest tab the script reads on every request

  • An Apps Script web app deployed as a permanent HTTPS endpoint that appends rows and sends email






Posting to your endpoint



One detail worth calling out: post with Content-Type: text/plain. That avoids a CORS preflight Apps Script can't respond to, and the script still parses the body as JSON.




// POST directly from your static site — no server proxy needed.
const res = await fetch(FORM_SCRIPT_URL, {
method: 'POST',
headers: { 'Content-Type': 'text/plain' },
body: JSON.stringify({
tab: 'contact',
fields, // { name, email, phone, message, ... }
}),
});
const data = await res.json();
// { result: 'success' } or { result: 'error', error: '...' }






The row appears in your Sheet and you get an email. That's it.






What's included





  • Email notifications on every submission, with a configurable subject


  • CC / BCC without exposing addresses in your frontend


  • Reply-to mapping — set a form field (like email) as the reply-to address


  • Honeypot spam protection — a hidden field bots fill out and the script silently discards


  • Multiple forms on one sheet as separate tabs sharing a single endpoint


  • Edit fields any time — add, remove, or relabel without reprovisioning


  • RGFORMS.md export — an AI skill file you can hand to Claude Code, Cursor, Copilot, or Windsurf so it wires up the form for you automatically






Limitations to know about



Apps Script on a free Google account caps email notifications at roughly 100/day. There's a one-time manual script authorization after provisioning (a Google requirement for scripts deployed via API), and the Apps Script API has to be enabled on your account first — RG Forms detects this and links you straight to the toggle. Spam protection is honeypot-only, so high-traffic forms should add reCAPTCHA on the frontend.






Why I built it



Formspree, Typeform, and similar tools are great but either cost money at scale or lock your data in their system. Since Apps Script runs inside Google's infrastructure under your own account, it's free within Google's generous quotas and your data never leaves your control.






Try it



rgforms.com — takes about 90 seconds to set up. There's a full how-it-works walkthrough too.



Would love feedback, especially if you've hit the same frustration with form backends on static sites.

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
IR-PLAYBOOK-RCE
HIGH
SOC Incident Playbook: Remote Code Execution (RCE) Defense
1-Click Detection Engineering: Sigma & YARA Rules
SOC Ready
title: Detect Exploitation - How to add a contact form to your static site — no backend, no monthly fee
id: b73cd410-828b-421f-95b9-d379b8606511
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "How to add a contact form to y" ascii wide
    condition:
        any of them
}
Infrastructure Blast Radius & Exposure
HIGH CASCADING
Perimeter & External Ingress
GEFÄHRDET (85%)
Lateral Movement & Pivot
Geringes Risiko
Data Stores & Crown Jewels
GEFÄHRDET (95%)
Supply Chain & Cascading Reach
Geringes Risiko
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich How to add a contact form to your static.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten How to add a contact form to your static site — no backend, no monthly fee

Thematisch verwandte Begriffe: contact, form, your, static · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-96676 | A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impa…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick