Reserved fields

Three field names carry special meaning to PostTo beyond the four canonical roles covered on the field mapping page. All three are stripped before your submission is stored or emailed — they're control fields, not data.

_hp — the honeypot

Add a text input named _hp to your form and hide it with CSS (not type="hidden" — some bots specifically skip those). Real visitors never see or fill it; simple bots that fill in every field will. If _hp arrives with any value in it, PostTo returns what looks like a completely normal success response — the same redirect or JSON a real submission would get — so the bot has no signal that anything was blocked. Nothing is stored and no email is sent. Full detail on this and the other spam layers is on the spam protection page.

<input type="text" name="_hp" style="display:none" tabindex="-1" autocomplete="off">

_next — where to send the visitor next

By default, a plain HTML form submission (one without Accept: application/json) redirects to a simple hosted "thanks" page after a successful submission, or to your endpoint's own success page if you've configured one under Settings. Add a hidden field named _next to override that on a per-submission basis — useful if the same PostTo endpoint is reused across several pages that should each redirect somewhere different:

<input type="hidden" name="_next" value="https://example.com/thank-you">

The value must be a real http:// or https:// URL. This field only affects plain-HTML-form submissions — it has no effect on JSON/API calls or signed-mode requests, which always get a JSON response back instead of a redirect.

cf-turnstile-response — Turnstile verification

If you've enabled Cloudflare Turnstile on an endpoint, its widget submits its result under this field name automatically — you don't set it yourself. See spam protection for the full setup.