Migrating from FormSubmit: every underscore field mapped

FormSubmit's core design decision is that your email address is the endpoint: the form posts to formsubmit.co/you@example.com, or to a random alias that hides it. Everything else is configured through hidden fields with underscore names. WebForms uses the same underscore convention, so about half your fields survive unchanged - and the other half move into a dashboard, which is the actual upgrade. Field behavior below is verified against FormSubmit's live documentation as of September 3, 2026.

The endpoint: your address stops being public

A WebForms endpoint is a key, not an address: send.webforms.to/wft_your_key. Where the submissions go is configured privately in the dashboard, which has two consequences. Your email address appears nowhere in your page source - FormSubmit's random-string alias exists to patch exactly this, and here it is simply the default. And changing where notifications go is a dashboard edit, not a redeploy of every page carrying the old address.

<form action="https://formsubmit.co/you@example.com" method="POST">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

<form action="https://send.webforms.to/wft_your_key" method="POST">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

Fields that rename trivially or not at all

• _replyto -> _replyto: identical. And like FormSubmit, a field named email becomes the reply-to automatically, so most forms never need it.
• _subject -> _subject: identical.
• _cc -> _cc: identical, comma-separated addresses.
• _next -> _redirect: same job - full URL of your own thank-you page - different name.
• _honey -> _gotcha: same honeypot trick, different field name. Hide it with CSS; a filled value silently discards the submission.

Fields that become dashboard configuration

FormSubmit has no dashboard, so everything must ride inside the form markup. That is elegant until you need to change behavior across twelve deployed pages. These four move to per-form settings you edit once:

• _blacklist -> spam settings: blocked keywords and blocked domains live on the form's spam config, alongside a layered filter (honeypot, time trap, disposable-email blocking, link-flood heuristics, optional AI review) rather than a phrase list alone.
• _autoresponse -> auto-responder: subject, body and sender name, configured per form. Same requirement as theirs: the form needs an email field to know where to send it.
• _template -> notification templates: pick per form in the dashboard; premium templates are a paid add-on, three are free.
• _webhook -> a webhook destination: not a field but a first-class destination with HMAC signing, retries and a per-attempt delivery log. One submission can hit your webhook and your inbox and a Slack channel at once.

One field disappears entirely: _captcha. FormSubmit enables reCAPTCHA by default and the field turns it off. WebForms does not force a captcha on your visitors; spam filtering runs server-side by default, and Turnstile, hCaptcha or reCAPTCHA are opt-in per form if you want a challenge as well.

The retention difference

FormSubmit keeps submissions for 30 days and its archive API allows five reads a day. WebForms stores submissions as the primary record - searchable and exportable from the dashboard, with retention set by plan rather than fixed at 30 days, and a Submissions API without a five-call ceiling on paid plans. If part of your workflow was forwarding notification emails to keep a record, the record now just exists.

AJAX forms

FormSubmit's AJAX endpoint is a separate URL (formsubmit.co/ajax/...). Here it is the same endpoint: send an Accept: application/json header and you get JSON back instead of a redirect, with ok, an id, and a stable error code on failure. No second URL to manage.

The checklist

1. Create a form, add your email as a destination in the dashboard, copy the endpoint.
2. Swap the action URL - your address leaves the markup.
3. Rename _next to _redirect and _honey to _gotcha; leave _replyto, _subject and _cc alone.
4. Recreate _blacklist phrases as blocked keywords in spam settings.
5. Recreate _autoresponse in the auto-responder settings.
6. Point your _webhook URL at a webhook destination and verify its HMAC signature.
7. Delete _captcha; opt into a captcha in spam settings only if you want one.
8. Submit once for real and check the delivery log.