How Submit Kit works

Every submission takes the same path, and it is short on purpose.

1. 1. Your visitor submits the form. The browser posts directly to your form's endpoint.
2. 2. We check it is not abuse. The request must come from a domain you listed, carry a valid Turnstile token solved on your site, leave the hidden honeypot field alone, and stay inside the rate limits.
3. 3. We validate the fields. Anything you did not declare is discarded. Everything else is checked against the type and length you set.
4. 4. We send you an email. Plain text and simple HTML, from a fixed address, to the recipient in your configuration.
5. 5. We forget it. The submission is not written to any database or queue.

What a request can and cannot decide

A submission chooses only one thing: which form it belongs to. The recipient address, the sending identity, the subject prefix, the success redirect, and the list of permitted domains all come from server-side configuration.

This matters more than it may sound. Because the success redirect must be a page on a domain the form already trusts, there is no configuration in which an attacker can redirect your visitors somewhere else — not a rule we enforce, but a thing that cannot be expressed.