# Freeform

> Build forms in EmDash with an AI-assisted builder, spam scoring, email notifications, webhooks, and CSV exports.

Source: https://emdashcmseverything.com/plugins/freeform/

- Category: forms
- Status: available
- Version: 0.1.4
- Price: Unknown
- Compatibility: Not stated in the public registry profile
- License: MIT
- Maintainer: Solspace
- Download: https://plugins.emdashcms.com/plugins/@solspace.com/freeform
- Repository: https://github.com/solspace/emdash-freeform
- Published: 2026-10-21

## Description

# Freeform for EmDash

Build forms, collect submissions, and act on them — without leaving EmDash.

**Form builder**

- 13 field types: text, email, textarea, number, phone, date, checkboxes, radio, dropdowns, multi-select, hidden, and HTML blocks
- Row-based layout with per-field validation (length, pattern, min/max)
- An AI builder that creates and edits forms from a plain-English description
- Starter forms for contact and newsletter signup out of the box

**Submissions**

- A searchable submissions inbox with pagination and full detail views
- AI submission briefs: intent, urgency, key facts, and a suggested next action
- CSV export for spreadsheets and reporting

**Automation & protection**

- Email notifications with reusable templates, sent to you or the submitter
- Signed webhooks (HMAC-SHA256) with automatic retries and a delivery log
- Spam scoring with honeypot + CSRF protection on every submission
- Optional MCP server so AI agents can manage forms and read submissions

Forms render on your site with the companion `@solspace/freeform-astro`
package, which ships unstyled components you theme with your own CSS.

## Installation

# Installation

## 1. Install the plugin

In your EmDash admin, go to **Plugins → Registry**, find **Freeform**, and
install it. Freeform appears in the sidebar once installed.

## 2. Render forms on your site

Freeform's admin lives in the plugin; the public forms are rendered by a
small companion Astro package:

```bash
pnpm add @solspace/freeform-astro
```

```ts
// astro.config.mjs
import { defineConfig } from "astro/config";
import emdash from "emdash/astro";
import freeformAstro from "@solspace/freeform-astro";

export default defineConfig({
  integrations: [emdash(), freeformAstro()],
});
```

Then embed any form by its handle:

```astro
---
import { FreeformForm } from "@solspace/freeform-astro/components";
---

<FreeformForm formId="contact" />
```

## 3. Optional: AI features

The AI form builder, spam scoring, and submission briefs need your own
Anthropic API key. Add it under **Freeform → Settings**. Without a key,
everything else — building forms by hand, submissions, email, webhooks —
works normally.

## FAQ

# FAQ

**Do I need an API key?**
Only for the AI features (AI form builder, AI spam scoring, submission
briefs). Add your own Anthropic API key in Freeform → Settings. Forms,
submissions, email notifications, and webhooks work without one.

**How are submissions protected from spam?**
Every form ships with a honeypot field and signed CSRF tokens. If you add
an Anthropic key, each submission also gets an AI spam score and is flagged
against a threshold you control, per form or globally.

**Can I get notified about new submissions?**
Yes. Create an email template, assign it to a form, and choose whether it
goes to the submitter (using their email field) or to a fixed address. You
can also fire signed webhooks to any URL on every submission.

**How do I export submissions?**
From the Submissions view you can download a CSV for any form, or generate
a short-lived export link.

**Can AI agents manage my forms?**
Yes. Freeform ships an optional MCP server (`emdash-freeform-mcp`) that
exposes form and submission tools to clients like Claude and Cursor.

**Are the rendered forms styled?**
No — by design. `@solspace/freeform-astro` renders semantic HTML with
`data-freeform-*` attributes so the forms match your site's design system.

## Security

# Security

**Reporting a vulnerability**

Email **support@solspace.com**. Please do not open a public issue for
security problems.

**How Freeform protects your site**

- Submission forms carry a honeypot field and HMAC-signed CSRF tokens
  (timing-safe verification, 2-hour expiry).
- Outbound webhooks are signed with HMAC-SHA256 (`X-Freeform-Signature`)
  so receivers can verify authenticity.
- API keys you provide (e.g. Anthropic) are stored in your site's own
  plugin storage — they are never sent to Solspace.
- Export links are short-lived, signed tokens; they expire automatically.