The PHP Problem

Contact forms on static sites usually mean PHP. And PHP on shared hosting is a security disaster waiting to happen. Outdated versions, vulnerable mail() implementations, form spam.

I wanted contact forms without servers. Enter AWS Lambda.

The Architecture

serverless-go-forms provides a simple Lambda function that:

  1. Receives POST from static site via API Gateway
  2. Validates input (honeypot, rate limiting)
  3. Sends via SES or forwards to another endpoint
  4. Returns CORS-friendly response

Go on Lambda

Go compiles to a single binary. Cold starts are fast (~10ms). The runtime is minimal. Deployment is a ZIP upload.

func handler(ctx context.Context, req events.APIGatewayProxyRequest) (events.APIGatewayProxyResponse, error) {
    var form ContactForm
    if err := json.Unmarshal([]byte(req.Body), &form); err != nil {
        return response(400, "Invalid JSON"), nil
    }
    
    if err := validate(form); err != nil {
        return response(400, err.Error()), nil
    }
    
    if err := sendEmail(form); err != nil {
        return response(500, "Failed to send"), nil
    }
    
    return response(200, "Message sent"), nil
}

Cost

The Lambda free tier covers 1M requests/month. For a personal site, that's effectively free. Compare to $5-10/month for shared hosting.