diff --git a/contact-urgent.md b/contact-urgent.md
index 5c97d7a..9b012a9 100644
--- a/contact-urgent.md
+++ b/contact-urgent.md
@@ -5,7 +5,7 @@ title: Urgent Contact
 
 If you have an access token then you can send me an urgent message using this form:
 
-<form id="contact-form" method="post" action="/api/contact-urgent">
+<form id="contact-form" method="post" action="/api/form/contact-urgent">
   <fieldset style="display:none">
     <label for="name">Leave blank if you're human:</label>
     <input type="text" name="name" id="name" placeholder="Leave blank if you're human">
diff --git a/contact.md b/contact.md
index f2cbcac..1492f52 100644
--- a/contact.md
+++ b/contact.md
@@ -5,7 +5,7 @@ title: Contact
 
 If you'd like to get in touch then you can contact me using the below form.
 
-<form id="contact-form" method="post" action="/api/contact">
+<form id="contact-form" method="post" action="/api/form/contact">
   <fieldset style="display:none">
     <label for="name">Leave blank if you're human:</label>
     <input type="text" name="name" id="name" placeholder="Leave blank if you're human">
diff --git a/functions/api/contact-urgent.js b/functions/api/form/contact-urgent.js
similarity index 92%
rename from functions/api/contact-urgent.js
rename to functions/api/form/contact-urgent.js
index f51d6df..340e891 100644
--- a/functions/api/contact-urgent.js
+++ b/functions/api/form/contact-urgent.js
@@ -1,4 +1,4 @@
-import { handleForm } from "../../functions-src/forms.js"
+import { handleForm } from "../../../functions-src/forms.js"
 
 export async function onRequest(context) {
   if (context.request.method !== "POST") {
diff --git a/functions/api/contact.js b/functions/api/form/contact.js
similarity index 89%
rename from functions/api/contact.js
rename to functions/api/form/contact.js
index 15e87be..ec8c623 100644
--- a/functions/api/contact.js
+++ b/functions/api/form/contact.js
@@ -1,4 +1,4 @@
-import { handleForm } from "../../functions-src/forms.js"
+import { handleForm } from "../../../functions-src/forms.js"
 
 export async function onRequest(context) {
   if (context.request.method !== "POST") {
diff --git a/functions/secure/api/form.js b/functions/secure/api/form.js
new file mode 100644
index 0000000..db2394b
--- /dev/null
+++ b/functions/secure/api/form.js
@@ -0,0 +1,20 @@
+export async function onRequest(context) {
+  if (context.request.method !== "GET") {
+    return new Response("Invalid request method", { status: 405 });
+  }
+
+  const submissions = await context.env.DB_FORMS.prepare("SELECT * FROM submissions WHERE submitted_ts > ?")
+    .bind(
+      new Date().subtractDays(30).toISOString(),
+    )
+    .all();
+
+    return Response.json(submissions);
+}
+
+// TODO: this is bad practice, consider replacing (see https://www.reddit.com/r/learnjavascript/comments/qgtut6/comment/hi8jg6w/)
+Date.prototype.subtractDays = function(days) {
+  var date = new Date(this.valueOf());
+  date.setDate(date.getDate() - days);
+  return date;
+}