You can prepare your workspace, projects and form drafts immediately. Open the verification email and confirm your address before publishing a form or sending its first submission. Account verification guide.
1Create your workspace
Start free and give your workspace a recognizable name. Save the recovery information shown during account setup.
2Create and publish your form
Open Forms and choose Create form. The guide takes you through these decisions in order. Use Save & continue to keep each step; nothing is published automatically.
| Setup step | Your decision |
|---|---|
| 1. Form details | Name the form and choose its project. |
| 2. Fields & behavior | Match your website’s field names, validation, and required values. An optional HTTPS thank-you page replaces the standard receipt page. |
| 3. Protection & files | Review the honeypot and rate limit, optionally limit responses per email or matching content, and choose whether to allow private attachments. |
| 4. Response delivery | Choose whether to add webhooks. Optionally open Email notifications to select verified recipients and included fields. Developer and Pro can also enable a branded submitter autoresponder. Then return to review delivery. |
| 5. Website connection | Choose Website form or Trusted server. For browser forms, choose Standard or Enhanced protection, review allowed origins, and enable the connection. |
| 6. Review & publish | Finish the checklist, confirm your choices, and choose Publish form. Account and owner verification remain separate checks. |
| 7. Connect & test | Copy the endpoint and integration example, send a response from your website, and check for its arrival. |
You can leave after saving and open the draft from Forms to resume. Existing forms also have an Open the guided setup & checklist link. Configuration, Sources, and Versions remain available for direct editing. Understand connection readiness.
No webhooks keeps HTTPS delivery off; email settings are independent. An inbox-only form with no email recipients or autoresponder is a complete setup. To send visitors a branded confirmation on Developer or Pro, open the form’s Autoresponder tab. Set workspace branding, map a required Email field, write the message, enable Enhanced protection on website sources, preview, and publish. Follow the autoresponder guide →. Email notifications are optional. Add a verified recipient in Notifications, choose recipients and fields in the form’s Email notifications settings, then publish. Read the notification guide.
3Connect your existing HTML
Choose Website form for HTML or browser JavaScript. In Connect & test, copy the endpoint or the example generated from your published settings. In the example below, replace YOUR_SOURCE_PUBLIC_KEY with your source key. Every field you want to submit needs a name matching your published rules.
<form action="https://submit.formbastion.com/f/YOUR_SOURCE_PUBLIC_KEY"
method="POST" enctype="multipart/form-data">
<label for="contact-name">Your name</label>
<input id="contact-name" name="name" maxlength="100" required>
<label for="contact-email">Your email</label>
<input id="contact-email" name="email" type="email" required>
<label for="contact-message">Your message</label>
<textarea id="contact-message" name="message" required></textarea>
<input name="_gotcha" type="text" tabindex="-1"
autocomplete="off" hidden>
<button type="submit">Send message</button>
</form>The honeypot above matches the default _gotcha field; update it if you change the published setting. A non-empty honeypot is held in quarantine.
For a backend integration, choose Trusted server instead. Save the private source secret when it is shown; it is displayed only once. The final step provides a cURL example using that secret as a bearer header. Keep it on your server.
Add enhanced protection with one script
Standard HTML works without a script. To add signed, expiring, one-use attempts and a randomized honeypot, add <script src="https://cdn.formbastion.com/bastion.js?v=2" defer></script> once to your page, then choose Enhanced in the connection’s Browser protection setting. The guide includes a copyable script and confirms a protected response. Follow installation, retry, and custom JavaScript guidance.
4Send a submission and review it
Send a test using information you control, then choose Check for a response in Connect & test. The guide does not send anything automatically. Your test uses the normal submission allowance and runs any configured, enabled webhooks. After storage, a normal HTML request receives a 303 redirect to the configured success URL or a generic receipt page. Open Inbox in your workspace to inspect the saved fields and the version that received them. The final setup step confirms an accepted response from the selected source using the current published version after that connection was reviewed; a quarantined response does not complete it. If you configured a webhook, open Activity and choose Webhook deliveries to follow its outcome. A saved response and successful webhook delivery are separate results.
Prefer a JSON response?
Send Accept: application/json. Successful ingestion returns 202 Accepted and a receipt. Use an Idempotency-Key for a retry of the same logical submission. A changed payload needs a new key; reusing a key with different content returns 409.
For browser JavaScript, configure the source’s allowed origins and do not manually set a multipart Content-Type when using FormData. The browser supplies its boundary.