What it is
A free inspector for HTML forms and the endpoints behind them. It points at the exact field or setting that drops data.
Contact form leak finder
Find where your form loses leads.
Most broken forms look fine. The button works, the thank you message shows, and the lead never arrives. Form Leak reads your form like a plumber reads pipes, field by field, then sends a real test submission to the endpoint and tells you whether the data made it.
Who it is for
Founders, marketers, freelancers and developers who run a contact, signup or quote form and need leads to land every time.
What it solves
Silent loss. A missing name attribute, a disabled field or a redirect after submit can drop a lead with no error anywhere.
Inspect a form
Check the markup first, then test the endpoint it posts to.
Paste the whole page or only the form. It is read in your browser and never sent anywhere.
Nothing inspected yet
Load the demo form to see six typical leaks traced on a blueprint.
Pasted HTML stays in your browser. Page fetches and test submissions run once from a Vercel server and are not stored.
Leak guide
What each finding means and how to fix it.
Field without a name
Browsers only send fields that have a name attribute. Add name="email" or similar to every field you want to receive.
Two fields share a name
Most backends keep only one value. Give each field its own name.
Form sends nowhere
The action is empty or a hash, so the form posts back to the same page. Point it at your form service or backend.
Disabled field
Disabled fields are never sent. Use readonly if visitors should see but not change the value.
Files without the right encoding
File uploads need the multipart encoding in the enctype attribute, or only the file name arrives.
Sends over plain http
Browsers warn visitors and some block the submission. Use an https endpoint.
Private data in the address
With method get, passwords or card numbers land in the URL, server logs and history. Use method post.
No submit button
Without a submit button, pressing Enter may do nothing. Add a button with type submit.
Fields outside the form
Inputs outside the form tag are not sent unless they carry a form attribute that points to it.
Action is a script
If that script fails or is blocked, nothing is sent. Use a real endpoint in action and enhance it with JavaScript.
Email typed as plain text
Use type email so phones show the right keyboard and typos are caught before sending.
Email is optional
If you need to reply, mark the email field required so empty leads cannot be sent.
Field without a label
Screen readers announce nothing and placeholders vanish while typing. Add a label.
Autofill turned off
Autofill speeds up contact details and cuts typos. Remove autocomplete off from name, email and phone.
Posts to another service
Fine for form services. Make sure that service forwards to an inbox someone reads.
Spam trap found
A hidden bait field catches bots without bothering people. Nothing to fix.
How to use it
Read the form
Paste the form HTML, or the page address. Every field is drawn as a pipe and every leak is marked where it happens.
Fix the leaks
Each finding comes with a one line fix. Leaks lose data, drips lose some visitors, notes are worth a look.
Test the endpoint
Send one test submission to the action address. Form Leak follows every redirect and tells you if the data survived.
What it does not do
- It does not run your page scripts, so forms that only appear after JavaScript need their rendered HTML pasted in.
- It cannot see inside your inbox or CRM. A delivered test proves the endpoint received the data, not that someone read it.
- Captcha protected endpoints will reject the test on purpose.
Questions
Will the test show up in my inbox?
Probably, and that is the point. It is named Form Leak test and carries a short token so you can match it.
Why is a redirect after submit a leak?
Browsers turn a POST into a GET after 301, 302 or 303. The page still loads, but the form data is gone. Use 307 or 308, or redirect only after saving.
Is my HTML stored?
No. Pasted HTML is read inside your browser. Fetched pages and tests are not kept.