Notifly in Tilda

Tilda is a site builder without a backend, but its forms have one important capability: sending data to a webhook. On submit, Tilda makes a POST with the form fields to the specified URL. There are two ways to turn this into a Notifly push: your own mini receiver in PHP, or straight through the Webhook Router — without a single line of code.

Option 1: a tiny PHP receiver

Place a single file on any host with PHP and point the form’s webhook URL at it (Site settings → Forms → Webhook). The receiver validates a secret, collects the fields and calls the shared notifly_send() — the same one as for the other CMSes.

<?php
// tilda-receiver.php — receives the Tilda webhook and sends a push
require __DIR__ . '/notifly.php'; // notifly_send() is defined here

// 1. Secret validation. Tilda does not sign the request, so we add our own
//    secret to the webhook URL: .../tilda-receiver.php?secret=XXXX
$secret = getenv('TILDA_SECRET') ?: 'change-me';
if (!hash_equals($secret, $_GET['secret'] ?? '')) {
    http_response_code(403);
    exit('forbidden');
}

// 2. Tilda sends the fields as a regular POST (application/x-www-form-urlencoded).
$data = $_POST;

// Tilda service fields — we don't show them in the notification.
unset($data['tranid'], $data['formid'], $data['formname'], $data['test']);

// 3. Build a readable body.
$lines = [];
foreach ($data as $k => $v) {
    if (is_string($v) && $v !== '') {
        $lines[] = "$k: $v";
    }
}

$formName = $_POST['formname'] ?? 'Форма Tilda';

notifly_send(
    "✉️ Заявка: $formName",
    implode("\n", $lines),
    7
);

// 4. Tilda expects a fast 200 OK, otherwise it shows the user an error.
echo 'ok';

Important about security:

• Tilda does not sign the webhook. The only out-of-the-box protection is the secret in the URL, so use a long random string and HTTPS.
• Don’t log PII. If you store the submissions, encrypt or strip fields with phone/email.
• Respond quickly. Send to Notifly with a short timeout (in notifly_send() it is already 5 seconds) so the form doesn’t “hang”.

The serverless version of the same receiver (Yandex Cloud Functions, AWS Lambda, Vercel) looks identical: the same POST parsing, the same secret check, the same Notifly call — just wrapped in the function’s handler.

Option 2: straight into the Webhook Router

If you don’t want to keep even a single PHP file — point the Tilda webhook straight at Notifly’s Webhook Router. The router accepts any JSON, checks the rules and renders title/message from a template.

1. In the Notifly admin, open the router and copy the public URL like https://notifly.ru/router/R<token>/tilda.
2. Paste this URL into the form’s webhook field in Tilda.
3. Create a rule with the path /tilda and templates:

titleTemplate:   ✉️ Заявка: {{default "Форма Tilda" .Payload.formname}}
messageTemplate: Имя: {{default "—" .Payload.Name}}
                 Телефон: {{default "—" .Payload.Phone}}
                 Email: {{default "—" .Payload.Email}}

The router saves the full payload in the event history, so the first test submit of the form is convenient to use as a sample: look at the real field names (Name, Phone, Email, etc.) and build a template around them, or generate a rule from the example.

About router security:

• The token R… in the URL itself acts as the secret — keep it private, and if it leaks, rotate it (rotate-token).
• You can add a filter condition to the rule (for example, the test field not equal to test) to weed out Tilda’s test submissions.

Which option to choose

	PHP receiver	Webhook Router
Hosting needed	yes (1 file)	no
Secret validation	yourself (?secret=)	token in URL
Flexible logic	any in PHP	rules + templates
Quick start	minutes	minutes, no code

Benefits

• Landing-page enquiries — straight to your phone. No need to check Tilda’s mail.
• Works on any Tilda plan where form webhooks are available.
• Zero infrastructure in the second option — just a rule in Notifly.

What to improve next

• Different router paths (/tilda/lead, /tilda/callback) for different forms.
• Priority by form type: a callback request — louder than a regular enquiry.
• Passing UTM tags into extras for analytics.