Summary for Elements 3.0.9
The Form Component passes Required field settings from the Elements editor to the frontend as HTML5 required attributes, but the server-side endpoint at com.elementsplatform.formspack/api/index.php/email does not validate them. A POST with empty required fields — sent after the timing honeypot delay and with a valid config_path — returns 200 email_sent:true and delivers an empty email.
The client-side honeypot (website) and timing honeypot are enforced by the server as expected. Only the Required validation is missing.
Impact
Any client that bypasses HTML5 validation — a direct scripted POST, an aggressive iOS AutoFill that clears fields after validation, an assistive tool, or a bot that has learned the timing threshold — can deliver empty submissions. The site owner receives empty emails with no way to reach the sender. Observed multiple times in production on https://einfach-gute-webseiten.de before I added a client-side guard.
Workaround (what I do now)
Client-side capture-phase submit listener in my project’s HeadStart that calls event.preventDefault() when a [required] real field is empty, then triggers form.reportValidity(). Does not touch the reserved fields (website, _form), does not modify Elements’ required markers, does not remove novalidate. This is a workaround; the real fix belongs in the Form Component’s server code.
→ Please see the attached bug report for details.