# Bug report: Elements Form Component: Required fields not enforced server-side

**URL:** <https://forums.realmacsoftware.com/t/bug-report-elements-form-component-required-fields-not-enforced-server-side/57440>\
**Category:** Elements\
**Created:** [August 25, 2026, 5:05pm UTC](https://forums.realmacsoftware.com/t/bug-report-elements-form-component-required-fields-not-enforced-server-side/57440 "2026-08-25T17:05:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fuellemann](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/fuellemann/32/22871_2.png) [@Fuellemann](https://forums.realmacsoftware.com/u/Fuellemann)\
**Post date:** [August 25, 2026, 5:05pm UTC](https://forums.realmacsoftware.com/t/bug-report-elements-form-component-required-fields-not-enforced-server-side/57440/1 "2026-08-25T17:05:50Z")

</div>

## Summary for Elements 3.0.9

The Form Component passes `Required` field settings from the Elements editor to the frontend as HTML5 `required` attributes, but the server-side endpoint at `com.elementsplatform.formspack/api/index.php/email` does **not** validate them. A POST with empty required fields — sent after the timing honeypot delay and with a valid `config_path` — returns `200 email_sent:true` and delivers an empty email.

The client-side honeypot (`website`) and timing honeypot are enforced by the server as expected. Only the `Required` validation is missing.

## Impact

Any client that bypasses HTML5 validation — a direct scripted POST, an aggressive iOS AutoFill that clears fields after validation, an assistive tool, or a bot that has learned the timing threshold — can deliver empty submissions. The site owner receives empty emails with no way to reach the sender. Observed multiple times in production on [https://einfach-gute-webseiten.de](https://einfach-gute-webseiten.de) before I added a client-side guard.

## Workaround (what I do now)

Client-side capture-phase submit listener in my project’s HeadStart that calls `event.preventDefault()` when a `[required]` real field is empty, then triggers `form.reportValidity()`. Does **not** touch the reserved fields (`website`, `_form`), does **not** modify Elements’ `required` markers, does **not** remove `novalidate`. This is a workaround; the real fix belongs in the Form Component’s server code.

→ Please see the attached bug report for details.

[2026-08-25-form-required-server-side.md](https://forums.realmacsoftware.com/uploads/short-url/rzHoknEFBFz2uK6DWg84Lf4rsYX.md) (3.4 KB)

---

<div class="post-metadata">

**Author:** ![tpbradley](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/tpbradley/32/25503_2.png) [@tpbradley](https://forums.realmacsoftware.com/u/tpbradley)\
**Post date:** [August 25, 2026, 7:28pm UTC](https://forums.realmacsoftware.com/t/bug-report-elements-form-component-required-fields-not-enforced-server-side/57440/2 "2026-08-25T19:28:45Z")

</div>

Hi @Fuellemann,

Thanks for the write-up. You’re right: Required is only enforced in the browser right now, so a POST that skips HTML5 validation can send an empty mail.

We’ll add that check on the server so empty required fields are rejected there too. Your client-side guard is a good stopgap until then.

Cheers