diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..9d5ed4a
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,10 @@
+PUBLIC_CONTACT_FORM_ACTION_URL=/api/contact
+PUBLIC_CONTACT_FORM_SUCCESS_REDIRECT=http://localhost:4321/#contatti
+PUBLIC_CONTACT_FORM_MAILTO=
+PUBLIC_CONTACT_TURNSTILE_SITE_KEY=
+
+CONTACT_FORM_MODE=dev
+CONTACT_FORM_RESEND_API_KEY=
+CONTACT_FORM_FROM_EMAIL=
+CONTACT_FORM_TO_EMAIL=
+CONTACT_TURNSTILE_SECRET_KEY=
diff --git a/README.md b/README.md
index ee32d92..92786ab 100644
--- a/README.md
+++ b/README.md
@@ -50,3 +50,29 @@ If you deploy with Wrangler in CI/Cloudflare, build first and deploy using Astro
 - Deploy command: `npm run deploy:cf`
 
 This avoids entrypoint errors like `@astrojs/cloudflare/entrypoints/server` not found.
+
+## Contact form configuration
+
+Set these variables for the website contact form.
+
+Public (frontend):
+
+- `PUBLIC_CONTACT_FORM_ACTION_URL` (default `/api/contact`)
+- `PUBLIC_CONTACT_FORM_SUCCESS_REDIRECT` (absolute URL for `_next`)
+- `PUBLIC_CONTACT_FORM_MAILTO` (fallback only if `ACTION_URL` is empty)
+- `PUBLIC_CONTACT_TURNSTILE_SITE_KEY`
+
+Server-side (Cloudflare runtime / local `.env`):
+
+- `CONTACT_FORM_MODE` (`dev` or `live`)
+- `CONTACT_FORM_RESEND_API_KEY`
+- `CONTACT_FORM_FROM_EMAIL` (verified sender in Resend)
+- `CONTACT_FORM_TO_EMAIL` (recipient inbox or alias)
+- `CONTACT_TURNSTILE_SECRET_KEY`
+
+Mode behavior:
+
+- `dev`: accepts form and logs payload server-side (no real email send)
+- `live`: verifies Turnstile (if secret configured) and sends via Resend API
+
+Copy `.env.example` to `.env` for local development and configure the same keys in Cloudflare Pages/Workers for production.
diff --git a/src/data/home/cta.ts b/src/data/home/cta.ts
index 4e8af2f..9100396 100644
--- a/src/data/home/cta.ts
+++ b/src/data/home/cta.ts
@@ -1,4 +1,10 @@
 /** Call-to-action (blocco contatti / chiusura pagina) */
+const env = import.meta.env;
+const contactActionUrl = (env.PUBLIC_CONTACT_FORM_ACTION_URL ?? '/api/contact').trim();
+const contactSuccessRedirect = (env.PUBLIC_CONTACT_FORM_SUCCESS_REDIRECT ?? '').trim();
+const contactMailto = (env.PUBLIC_CONTACT_FORM_MAILTO ?? '').trim();
+const contactTurnstileSiteKey = (env.PUBLIC_CONTACT_TURNSTILE_SITE_KEY ?? '').trim();
+
 export const cta = {
   /** Riga sezione (stesso ruolo di FAQ, Stack, …) */
   eyebrow: 'Contatti',
@@ -27,19 +33,19 @@ export const cta = {
     emailLabel: 'Email',
     messageLabel: 'Scrivi qui il tuo messaggio',
     submitLabel: 'Invia messaggio',
-    /** Formspree: `https://formspree.io/f/xxxx` — vuoto = prova `mailto` */
-    actionUrl: '',
-    /** Formspree: redirect dopo invio (`_next`) — URL **assoluta** in produzione */
-    successRedirect: '',
+    /** Formspree: `https://formspree.io/f/xxxx` — valorizzato via `PUBLIC_CONTACT_FORM_ACTION_URL` */
+    actionUrl: contactActionUrl,
+    /** Formspree `_next` — URL assoluta in produzione (`PUBLIC_CONTACT_FORM_SUCCESS_REDIRECT`) */
+    successRedirect: contactSuccessRedirect,
     /**
      * Cloudflare Turnstile (anti-spam): inserisci qui la site key pubblica.
      * Se vuota, il CAPTCHA non viene mostrato.
      */
-    turnstileSiteKey: '',
+    turnstileSiteKey: contactTurnstileSiteKey,
     /** Formspree `_subject` e oggetto mailto */
     notifySubject: 'Richiesta contatto — sito NexStudio',
-    /** Se `actionUrl` è vuoto: email per `mailto:` (es. `info@tuodominio.com`) */
-    mailto: '',
+    /** Fallback se `actionUrl` e' vuoto (`PUBLIC_CONTACT_FORM_MAILTO`) */
+    mailto: contactMailto,
     fieldName: 'name',
     fieldCompany: 'company',
     fieldCountry: 'country',
diff --git a/src/pages/api/contact.ts b/src/pages/api/contact.ts
new file mode 100644
index 0000000..cdd52e7
--- /dev/null
+++ b/src/pages/api/contact.ts
@@ -0,0 +1,149 @@
+import type { APIRoute } from 'astro';
+
+export const prerender = false;
+
+type RuntimeEnv = Record<string, unknown>;
+
+function getRuntimeEnv(locals: unknown): RuntimeEnv {
+  if (
+    locals &&
+    typeof locals === 'object' &&
+    'runtime' in locals &&
+    locals.runtime &&
+    typeof locals.runtime === 'object' &&
+    'env' in locals.runtime &&
+    locals.runtime.env &&
+    typeof locals.runtime.env === 'object'
+  ) {
+    return locals.runtime.env as RuntimeEnv;
+  }
+  return {};
+}
+
+function readEnv(name: string, runtimeEnv: RuntimeEnv): string {
+  const runtimeValue = runtimeEnv[name];
+  if (typeof runtimeValue === 'string' && runtimeValue.trim().length > 0) {
+    return runtimeValue.trim();
+  }
+  const staticValue = import.meta.env[name];
+  return typeof staticValue === 'string' ? staticValue.trim() : '';
+}
+
+function sanitizeRedirect(candidate: string, requestUrl: URL): string {
+  if (!candidate) return '';
+  try {
+    const u = new URL(candidate, requestUrl);
+    return u.toString();
+  } catch {
+    return '';
+  }
+}
+
+function required(value: FormDataEntryValue | null): string {
+  return typeof value === 'string' ? value.trim() : '';
+}
+
+async function verifyTurnstile(token: string, secret: string, ip?: string | null): Promise<boolean> {
+  const body = new URLSearchParams();
+  body.set('secret', secret);
+  body.set('response', token);
+  if (ip) body.set('remoteip', ip);
+
+  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
+    method: 'POST',
+    body,
+  });
+  if (!response.ok) return false;
+  const payload = (await response.json()) as { success?: boolean };
+  return payload.success === true;
+}
+
+async function sendWithResend(apiKey: string, fromEmail: string, toEmail: string, subject: string, text: string) {
+  const response = await fetch('https://api.resend.com/emails', {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${apiKey}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({
+      from: fromEmail,
+      to: [toEmail],
+      subject,
+      text,
+    }),
+  });
+
+  if (!response.ok) {
+    const detail = await response.text();
+    throw new Error(`Resend error ${response.status}: ${detail}`);
+  }
+}
+
+export const POST: APIRoute = async ({ request, locals, url }) => {
+  const runtimeEnv = getRuntimeEnv(locals);
+  const mode = readEnv('CONTACT_FORM_MODE', runtimeEnv).toLowerCase() || 'dev';
+  const resendApiKey = readEnv('CONTACT_FORM_RESEND_API_KEY', runtimeEnv);
+  const fromEmail = readEnv('CONTACT_FORM_FROM_EMAIL', runtimeEnv);
+  const toEmail = readEnv('CONTACT_FORM_TO_EMAIL', runtimeEnv);
+  const turnstileSecret = readEnv('CONTACT_TURNSTILE_SECRET_KEY', runtimeEnv);
+
+  const form = await request.formData();
+  const redirectTarget =
+    sanitizeRedirect(required(form.get('_next')), url) ||
+    sanitizeRedirect(readEnv('PUBLIC_CONTACT_FORM_SUCCESS_REDIRECT', runtimeEnv), url) ||
+    sanitizeRedirect(request.headers.get('referer') ?? '/', url) ||
+    '/';
+
+  const name = required(form.get('name'));
+  const company = required(form.get('company'));
+  const email = required(form.get('email'));
+  const country = required(form.get('country'));
+  const message = required(form.get('message'));
+
+  if (!name || !email || !country || !message) {
+    return new Response('Missing required contact fields.', { status: 400 });
+  }
+
+  const turnstileToken = required(form.get('cf-turnstile-response'));
+  if (turnstileSecret) {
+    const isHuman = await verifyTurnstile(
+      turnstileToken,
+      turnstileSecret,
+      request.headers.get('CF-Connecting-IP'),
+    );
+    if (!isHuman) {
+      return new Response('Turnstile verification failed.', { status: 400 });
+    }
+  }
+
+  const subject = required(form.get('_subject')) || 'Richiesta contatto - sito NexStudio';
+  const text = [
+    `Nome: ${name}`,
+    company ? `Azienda: ${company}` : '',
+    `Email: ${email}`,
+    `Paese: ${country}`,
+    '',
+    message,
+  ]
+    .filter(Boolean)
+    .join('\n');
+
+  if (mode === 'live') {
+    if (!resendApiKey || !fromEmail || !toEmail) {
+      return new Response('Live mode requires CONTACT_FORM_RESEND_API_KEY, CONTACT_FORM_FROM_EMAIL and CONTACT_FORM_TO_EMAIL.', {
+        status: 500,
+      });
+    }
+    await sendWithResend(resendApiKey, fromEmail, toEmail, subject, text);
+  } else {
+    console.info('[contact:dev] Contact payload received', {
+      name,
+      company,
+      email,
+      country,
+      subject,
+    });
+  }
+
+  return Response.redirect(redirectTarget, 303);
+};