Use your existing form.

Recommended order

1. Use the form platform's built-in webhook feature.
2. Use a server-side form handler.
3. Use a same-origin proxy for custom browser JavaScript.
4. Configure receiving-server CORS only when direct browser posting is intentionally supported.

Recommended secure setup

For custom website forms, do not expose your PINGSLAP webhook URL in frontend JavaScript or HTML forms. Anyone who inspects the page or browser network traffic can copy the URL and send unwanted notifications into that Space.

Instead, submit the form to your own server-side handler. Your server reads the secret webhook URL from its environment configuration and forwards the alert server-to-server:

Keep the webhook URL in server-side environment or secret configuration rather than client-side code. A .env file or hosting platform environment variable is a familiar pattern:

PINGSLAP_WEBHOOK_URL=https://app.pingslap.com/v1/receive/spc_sample_token_keep_secret

A minimal server-side handler (such as a PHP script or serverless function) reads the configuration value, prepares safe fields, and POSTs server-to-server to PINGSLAP:

<?php
// submit.php - handles the form submission on your server
$webhookUrl = getenv('PINGSLAP_WEBHOOK_URL');

if (!$webhookUrl) {
    http_response_code(500);
    exit('Server configuration error');
}

$payload = json_encode([
    'title'   => 'New website form submission',
    'message' => $_POST['message'] ?? 'New submission received',
    'name'    => $_POST['name'] ?? '',
    'email'   => $_POST['email'] ?? '',
]);

$ch = curl_init($webhookUrl);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_exec($ch);
curl_close($ch);

echo 'Thank you for your message!';

Direct server integrations: Backend applications, automation platforms (n8n, Zapier, Make), and server-side WordPress plugins already run in private server environments where visitors cannot see the webhook URL. They do not need this extra proxy handler and can send directly to PINGSLAP.