Freeform
Build forms in EmDash with an AI-assisted builder, spam scoring, email notifications, webhooks, and CSV exports.
Plugin
Freeform
Build forms in EmDash with an AI-assisted builder, spam scoring, email notifications, webhooks, and CSV exports.
Description
Freeform for EmDash
Build forms, collect submissions, and act on them — without leaving EmDash.
Form builder
- 13 field types: text, email, textarea, number, phone, date, checkboxes, radio, dropdowns, multi-select, hidden, and HTML blocks
- Row-based layout with per-field validation (length, pattern, min/max)
- An AI builder that creates and edits forms from a plain-English description
- Starter forms for contact and newsletter signup out of the box
Submissions
- A searchable submissions inbox with pagination and full detail views
- AI submission briefs: intent, urgency, key facts, and a suggested next action
- CSV export for spreadsheets and reporting
Automation & protection
- Email notifications with reusable templates, sent to you or the submitter
- Signed webhooks (HMAC-SHA256) with automatic retries and a delivery log
- Spam scoring with honeypot + CSRF protection on every submission
- Optional MCP server so AI agents can manage forms and read submissions
Forms render on your site with the companion @solspace/freeform-astro
package, which ships unstyled components you theme with your own CSS.
Installation
Installation
1. Install the plugin
In your EmDash admin, go to Plugins → Registry, find Freeform, and install it. Freeform appears in the sidebar once installed.
2. Render forms on your site
Freeform’s admin lives in the plugin; the public forms are rendered by a small companion Astro package:
pnpm add @solspace/freeform-astro// astro.config.mjs
import { defineConfig } from "astro/config";
import emdash from "emdash/astro";
import freeformAstro from "@solspace/freeform-astro";
export default defineConfig({
integrations: [emdash(), freeformAstro()],
});Then embed any form by its handle:
---
import { FreeformForm } from "@solspace/freeform-astro/components";
---
<FreeformForm formId="contact" />3. Optional: AI features
The AI form builder, spam scoring, and submission briefs need your own Anthropic API key. Add it under Freeform → Settings. Without a key, everything else — building forms by hand, submissions, email, webhooks — works normally.
FAQ
FAQ
Do I need an API key? Only for the AI features (AI form builder, AI spam scoring, submission briefs). Add your own Anthropic API key in Freeform → Settings. Forms, submissions, email notifications, and webhooks work without one.
How are submissions protected from spam? Every form ships with a honeypot field and signed CSRF tokens. If you add an Anthropic key, each submission also gets an AI spam score and is flagged against a threshold you control, per form or globally.
Can I get notified about new submissions? Yes. Create an email template, assign it to a form, and choose whether it goes to the submitter (using their email field) or to a fixed address. You can also fire signed webhooks to any URL on every submission.
How do I export submissions? From the Submissions view you can download a CSV for any form, or generate a short-lived export link.
Can AI agents manage my forms?
Yes. Freeform ships an optional MCP server (emdash-freeform-mcp) that
exposes form and submission tools to clients like Claude and Cursor.
Are the rendered forms styled?
No — by design. @solspace/freeform-astro renders semantic HTML with
data-freeform-* attributes so the forms match your site’s design system.
Security
Security
Reporting a vulnerability
Email [email protected]. Please do not open a public issue for security problems.
How Freeform protects your site
- Submission forms carry a honeypot field and HMAC-signed CSRF tokens (timing-safe verification, 2-hour expiry).
- Outbound webhooks are signed with HMAC-SHA256 (
X-Freeform-Signature) so receivers can verify authenticity. - API keys you provide (e.g. Anthropic) are stored in your site’s own plugin storage — they are never sent to Solspace.
- Export links are short-lived, signed tokens; they expire automatically.