Free Contact Form PHP Script with Admin Inbox

FormZip replaces third-party form services with a single PHP file you own. Visitors get a clean contact form; you get an inbox panel with unread highlighting, mark read/unread, delete, sender IPs, and one-click CSV export. Optionally forward every message to your e-mail.

Spam is handled without annoying humans: an invisible honeypot field, a time trap (forms submitted within seconds are bots), and a per-IP hourly rate limit. Bot submissions are silently accepted-but-discarded, so bots never learn they were caught.

1. Upload formzip.php to your web space (e.g. public_html/contact/).
2. Open it in your browser once — storage bootstraps and locks itself down.
3. Open formzip.php?a=admin, generate your admin password hash with the built-in generator, paste it into the CONFIG block.
Optional: set FORWARD_TO in the CONFIG block to also receive messages by e-mail.

Paste this prompt into Claude to build this exact product:

Build a complete, production-quality single-file PHP application called FormZip: a self-hosted contact form whose messages land in a built-in admin inbox instead of a third-party form service.

Core flow: visitor fills name / e-mail / message; the message is stored; the owner reads it in an inbox panel; optionally each message is also forwarded by e-mail.

Hard requirements:

- One PHP file, PHP 8.1+, no database: messages in one JSON file with flock-guarded writes.

- CONFIG constants: DEMO_MODE, FORWARD_TO (empty = no e-mail forwarding; otherwise use PHP mail() with Reply-To set to the sender), MIN_SECONDS_TO_SUBMIT, MAX_PER_HOUR_PER_IP, ADMIN_PASSWORD_HASH, APP_NAME.

- Spam protection, three layers, no captcha: (1) an invisible honeypot field (absolutely positioned off-screen); (2) a time trap — store a session timestamp when the form renders and reject submissions faster than MIN_SECONDS_TO_SUBMIT; (3) a per-IP hourly rate limit counted from stored messages. Crucially: honeypot/time-trap hits must be shown the normal success message while saving nothing, so bots don't learn.

- Validate: name and message required with length caps, e-mail via filter_var.

- Admin inbox at ?a=admin: session login (password_hash, sleep(1) on failure), KPIs (total, unread, rate limit, forwarding on/off), message cards with unread highlighting, mark read/unread toggle, delete, sender IP + timestamp, and a one-click CSV export of all messages. CSRF everywhere, first-run hash generator.

- Demo mode: form renders, submissions and admin login disabled with a friendly message + banner.

- Clean dependency-free CSS, dark mode.

Also write a README.md: requirements, 3-step install, config table, how the three spam layers work, and honest limits (no captcha, no attachments, JSON scale).

What happened when we ran it: Claude (claude-fable-5) produced the complete file in one pass. Syntax check and the functional tests passed on the first attempt. Your result will differ slightly on every run — that's normal; the spec above pins the behavior, not the exact code.

Note: the download on this page ships with DEMO_MODE = false — no demo restrictions. The prompt is for reproducing (or remixing) the build yourself with your own Claude subscription.