Payload Contact

Payload Contact positions itself as the privacy-first, self-hosted alternative to hosted form services such as Formspree, Typeform or Google Forms for teams already running Payload CMS. Instead of POSTing visitor data to a third-party endpoint, it keeps the entire submission lifecycle inside your Payload application.

• No third-party form service — A complete contact channel native to your own app.
• Your data, your database — Submissions are a native Payload collection, fully owned and queryable.
• Native to Payload 3 — Installs as a first-class plugin, integrates with the admin UI and access control.
• No CAPTCHA — Honeypot and rate limiting stop bots without friction for real visitors.
• Open source & MIT-licensed — Free to use, extend and audit.

• A themeable React <ContactForm> component with name, email, optional subject and message fields
• A validated submit endpoint at /api/contact-api/submit
• An admin inbox: submissions stored in a dedicated collection with status tracking (new / read / replied)
• A dashboard view with submission counts and recent messages
• Optional SMTP email notifications on new submissions (v0.2.0+)
• Runtime settings global: form availability, message length limits, required fields and blocked keywords, no redeploy required
• Anti-spam built in: hidden honeypot field and per-IP rate limiting, no CAPTCHA
• Salted IP hashing rather than raw IP storage, plus server-side length, required-field and keyword-blocklist validation
• Install by vendoring the source or via pnpm add @navanem/payload-contact

Almost every site needs a contact form, and most teams reach for a hosted service to get one. That convenience comes at a price: visitor messages flow through someone else's servers, you pay a recurring SaaS bill, and your contact data lives outside the platform you already run. For organisations that care about data ownership and GDPR, routing inbound enquiries through a third party is an awkward trade-off.

Payload Contact removes it. Because it runs inside your own Payload application, the whole lifecycle, submission, validation, storage, triage and notification, stays on infrastructure you control. There is no external request on the critical path, no visitor data leaving your domain, and no per-seat or per-submission fee. For Payload teams that want a reliable contact channel without the privacy and vendor-lock-in baggage of hosted form services, it is the natural, self-hosted answer.