Form data you can trust: spam filtering, storage, and CSV export explained

Every form on the internet has the same life cycle: a visitor fills it in, hits submit, and the browser sends a POST request to the form's action URL. What happens after that is where form backends earn their keep — and where a lot of homegrown setups quietly fall apart. This article walks through the three things that actually matter: filtering the spam, storing the submissions, and getting your data out again.

What happens the moment someone hits submit

The browser bundles every field into name=value pairs and POSTs them to the form's action URL. The server at that URL then has to do three jobs: decide whether the submission is legitimate, store it somewhere durable, and make it available to you. None of these jobs are hard individually — the failure mode is doing them badly: trusting everything, storing in a location that vanishes on redeploy, or making the data impossible to get out.

Spam filtering, in order

Real form backends filter spam in layers, cheapest first:

• Honeypot fields. A hidden field humans can't see and bots fill anyway. If it comes back non-empty, the submission is almost certainly a bot, and it can be discarded silently — no error page, no friction for real visitors.
• Heuristics. Content-based checks applied at submission time: more than a few URLs across the text fields, an email domain on a known throwaway list, or a submission rate far beyond humanly possible. These flag suspicious submissions.
• Human review. The final layer is a person. A good backend marks likely-spam rather than deleting it, so a false positive is one click from recovery — and a submission that slipped through the filters can be flagged by hand.

The design principle is worth internalising: bots are stopped silently, suspicious submissions are flagged but never destroyed, and humans make the final call. Filtering that deletes things automatically is how real enquiries get lost.

Where submissions are stored

Underneath, a form backend stores submissions in a database: one row per submission, the fields as data, plus a timestamp and a spam flag. You never see the database — you see the dashboard, which lists submissions newest first and lets you open any one of them to read the fields as they were sent. Storage matters most when the alternatives are considered: an email inbox (messages get buried and forwarded out of order), a spreadsheet (gets overwritten and shared wrong), or nothing (the classic form that posts to a nonexistent page and silently drops every submission).

Getting your data out: CSV export

CSV is the universal table format: plain text, one row per record, one column per field, opened by every spreadsheet and imported by almost every tool on earth. A CSV export matters because it is the difference between a form backend being a service you use and a prison your data lives in. You might want the list in your CRM, your email tool, or a colleague's spreadsheet — a one-click CSV export makes all of those trivial, and it is the guarantee that you can leave any backend without losing anything.

What to ask of any form backend

• Does spam get flagged rather than deleted? You want the ability to recover a false positive.
• Can I see every submission, or only a recent window? You want the whole history visible, not paginated into oblivion.
• Is there a CSV export? If the answer is no, ask how you get your data out on day one, not on the day you need it.

FormHook was built to these three answers: submissions are stored in full and visible in a dashboard, spam is filtered with a honeypot and heuristics but flagged rather than removed, and every endpoint exports to CSV in one click. If you're evaluating backends, those are the questions that separate the useful ones from the rest.