The plain HTML form

The plain HTML form is a form element that posts straight to Issue Mint, with no script of any kind. Issue Mint prints it in Settings, then the Subscribers tab, underneath the script snippet.

It suits a hand-written page, a template that strips script tags, and anybody who would rather own the markup than accept somebody else’s. What it gives up is the in-place confirmation: this form navigates, where the script embed stays on the page.

The snippet

Four elements, and the action is the only line carrying anything specific to you.

<form action="https://app.issuemint.com/f/pk_3f9c1d7b2a8e4c05d1f6b3a9e7c2" method="post">
  <label for="im-email">Email address</label>
  <input id="im-email" type="email" name="email" required>
  <input type="text" name="website_url" tabindex="-1" autocomplete="off" style="position:absolute;left:-9999px">
  <button type="submit">Subscribe</button>
</form>

The f/ address ends in your newsletter’s public key, which is safe in a public page: it names the newsletter and grants nothing. There is no token in the form and nothing in it expires, so a page you built two years ago still works today. The label text, the button text, the classes and the layout are all yours to change. The two field names are not.

The hidden field is a honeypot

The third input, named website_url, is positioned off the side of the page. A reader never sees it and never fills it in. A naive bot fills every field it finds.

Anything arriving in website_url means the submission is dropped: no subscriber, no confirmation email, and a response that looks exactly like a success, because telling a bot it was caught only helps it adapt. It sits off-screen rather than under display: none, which some bots know to check for. Keep the field, keep it unlabelled, and never mark it required.

What happens to a signup from this form

The address is added to your list tagged as an embed signup, the same as one from the script, so your subscriber list shows where each person came from.

With double opt-in on, which is the default, the confirmation email goes out and the address stays pending until it is confirmed. An address whose domain has no mail server behind it is refused rather than stored, which is what catches a typo in the part after the @. The endpoint is rate limited by IP address, at twenty requests a minute and two hundred a day, shared with the script embed.

Where the reader lands afterwards

On a branded thank-you page hosted by Issue Mint, at your f/ address followed by /thanks, unless you have set a page of your own.

That page carries your newsletter’s name and a link back to your newsletter website. Its wording follows your double opt-in setting: with it on, the page says an email is on its way and the link inside it finishes the job; with it off, it says the next issue will land in the inbox.

Sending readers to your own page instead

Settings, then the Subscribers tab, has a field called “After signing up, send readers to”. A full address there replaces the branded page.

It has to be one of your own addresses. The allow-list is your {slug}.issuemint.com address, plus your verified custom domain and the www form of it, over http or https. Anything else is refused when you save, with a message naming the addresses that are allowed, rather than being accepted and quietly ignored later.

Issue Mint checks the address again at the moment each reader signs up, not only when you saved it. If a custom domain stops being verified, the redirect falls back to the branded page rather than sending readers somewhere that no longer answers. That recheck is also what stops an endpoint anybody can reach from becoming an open redirect on the strength of a rule that ran last month.

The setting applies to this form only. The script embed confirms in place and never navigates, so it ignores it.

What the plain form cannot do

Show a reader what went wrong without leaving your page. A rejected address sends them back to your site with no explanation, because Issue Mint holds no session on your domain and cannot write a message into your markup.

It also takes nothing from your branding. There is no colour, no font and no stylesheet in the snippet, so the form inherits whatever your site already says about labels, inputs and buttons, which is usually the point of choosing it. If you want both your own design and an error a reader can read in place, the options are set out in what you can change.