A contact form for GitHub Pages (no server required)
July 21, 2026
GitHub Pages is one of the most reliable and cost-effective ways to host static websites, documentation, and developer portfolios. However, GitHub Pages executes zero server-side code. It cannot run PHP, execute serverless functions, or connect to a mail server.
That limitation often leads site owners to fall back on fragile mailto: links (which fail on many devices and expose email addresses to scrapers) or give up on contact forms entirely.
With NormForms, you can add a rock-solid, spam-filtered contact form to any GitHub Pages site in a single git commit.
Step 1: Get your free form endpoint
Sign up for a free NormForms account. Setup takes 30 seconds with no credit card required. You will receive an endpoint URL formatted like https://normforms.com/f/YOUR_TOKEN.
Step 2: Add the form markup and push
Whether your GitHub Pages site is built with Jekyll, a static site generator, or plain HTML, paste this form markup into your page or layout:
<form action="https://normforms.com/f/YOUR_TOKEN" method="POST"> <label for="nf-name">Name</label> <input id="nf-name" type="text" name="name" autocomplete="name" required> <label for="nf-email">Email</label> <input id="nf-email" type="email" name="email" autocomplete="email" required> <label for="nf-message">Message</label> <textarea id="nf-message" name="message" required></textarea> <!-- Invisible honeypot traps spam bots silently --> <input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off"> <button type="submit">Send Inquiry</button> </form>
Commit and push to your repository. As soon as GitHub Pages builds, your contact form is live.
Spam protection built in: The _gotcha input is an invisible honeypot. Real visitors never see it, but automated spam scripts fill it out blindly, allowing NormForms to discard bot submissions without forcing human visitors to solve frustrating CAPTCHA puzzles.
Step 3: Lock your form to your domain
In your NormForms dashboard under Spam & Security, enter your GitHub Pages domain—either your username.github.io address or your custom apex domain (e.g. example.com).
Submissions from any other origin will be turned away automatically, preventing automated bots from POSTing directly to your endpoint.
Public code, private data
Because your GitHub repository may be public, you might wonder if committing your form's endpoint URL is secure.
Yes, completely. The endpoint URL is intended to be public (just like your form's HTML). Because the endpoint is protected by your domain origin lock, only submissions originating from your verified site are processed. Most importantly, you never have to commit sensitive SMTP passwords or private API keys to your git history.
Need a form without editing code?
Every NormForms endpoint also functions as a pre-built, responsive hosted page. You can link to it directly from your GitHub profile README, social bio, or project documentation with zero HTML required.