Gjallarform
Gjallarform
Most online contact form solutions assume you have a database, a plugin ecosystem, or money to spend on a third-party service.
Gjallarform assumes none of that.
I tried some "freemium" solutions, with external configuration, APIs, and technical dependencies out of my control. "Someone has to have a script somewhere," I thought. Yet I failed to find any. I wanted more control.
So I started looking in to what is required.
A lot of existing solutions seemed to rely on larger mailer libraries, framework-specific integrations, hosted backends, or older examples that were either too complex, outdated, or not quite suitable for a modern static site workflow.
I wanted something simpler, with more control, sensible security, and fewer assumptions about my hosting environment.
Gjallarform started from that requirement: a contact form I could understand, configure, upload, and trust — without handing the problem over to yet another external service.
The name comes from Norse mythology. Gjallarhorn is the horn Heimdall blows to signal that something important is happening. A contact form that alerts you to incoming messages seemed like a fitting reference, and it has the advantage of being genuinely unique.
What it is
Four files: a PHP processor, a JavaScript file, and two HTML templates. You drop them into a directory on your server, edit one configuration block, and you have a working contact form with spam protection. No framework, no database, no API keys, no recurring cost. It runs on the cheapest shared hosting available.
The spam defense is layered. A honeypot field catches automated bots silently — they think the form succeeded, no email is sent. A time trap rejects submissions that arrive suspiciously fast. A simple arithmetic question stops the human operators who get past the automated defenses. Each layer can be turned on or off independently depending on how much friction you want to add for legitimate users.
How it was built
Gjallarform was developed collaboratively with Claude (Anthropic) and, initially, ChatGPT (OpenAI) affectionally called Gepetto, over several months, handling architecture, implementation, and security review. The code has been manually reviewed throughout and tested under real conditions — including a live spam attack that accelerated the development of the math challenge feature. It is not a theoretical project. It runs on conram.it and on rikardmalmborg.se, and has been doing so long enough to have encountered and - after several revisions - survived a series of challenges.
The development approach was deliberate: consolidate and simplify before adding features, document honestly rather than impressively, and always ask whether something serves the person deploying it in six months with no memory of today's decisions. Because it matters.
Current state
Version 0.95 is a public beta. The core functionality is stable. The templates require adaptation to your site's design and path structure, and the documentation covers both the straightforward deployment and the more involved cases like static site generators and directory-based URLs. Issues and questions are handled through GitHub.
- PHP 8.1 or higher, with
mail()enabled - No other requirements