What it does
Every finished submission on a form with spam protection on needs a one-time pass from Cloudflare Turnstile, usually unseen. When Turnstile can't run, the browser solves a small puzzle by itself in about a second. Finishing a saved partial is checked too. Spam protection is on by default.
A form's rate limit allows one submission a minute from each device. Firewall limits cover sign-in, the API and form pages, and the API takes 60 requests a minute on Free and 600 on Pro and Business.
Stored with a slow hash. Guesses are limited to 10 per device every 15 minutes and 200 per form an hour. Opening a protected form lasts 12 hours in that browser, and ends when you change the password.
People can't upload web pages or scripts, whatever a question accepts. Webhooks go only to public https addresses, checked again before every delivery. Custom CSS stays inside the form and can load only your own uploads and Google Fonts.
Emails to people who answer go only to the address they typed into the form's email question, with daily limits: 5 to any one address, and 200, 2,000 or 10,000 for an account's forms on Free, Pro and Business.
Formkit is served over HTTPS only, and its sign-in and app pages can't be framed by other sites. Data is stored in the United States.
Which plan includes it
- Spam check and rate limits
- Passwords on forms
- Safe uploads and webhooks
- 200 emails to respondents a day
- 60 API requests a minute
- 2,000 emails to respondents a day
- 600 API requests a minute
- 10,000 emails to respondents a day
- Audit log
- Data retention rules
- Sign-in with your company’s Google Workspace
How to start
- 1Keep spam protection on in Settings → Security
- 2Keep the rate limit on for busy public forms
- 3Add a password to a form that needs one
- 4Add two-factor or a passkey to your account
Templates to start from
Every templateGoes well with
In the help centre
- 1 min readSpam protectionKeeping bots out of a public form.
- 1 min readData, retention and deletionWhat Formkit stores, and how to get rid of it.
- 1 min readSign in with a passkeyFace ID, a fingerprint or your device's PIN instead of the password.
- 1 min readSomeone cannot open my formWhat respondents see when something is wrong on your side.
Questions
Is spam protection on every plan?
Yes, and it is on by default.
Where is my data stored?
In the United States.
Can I see what Formkit emailed?
Yes. A form's email log lists everything sent, including any email skipped because a daily limit was reached.
Try it on your next form.
Free to start, with unlimited forms, responses and members. See what each plan includes on the pricing page.