Form Settings
Configure notifications, redirects, CAPTCHA, spam protection, and manage your form.
Each form has a Settings tab with four sections: General, After submit, CAPTCHA, and (for the form owner) Danger zone.
Only workspace Admins can access Settings. Members can view submissions but cannot change settings.
General
Active toggle
When a form is inactive, all incoming POST requests are rejected with 404. Use this to pause a form without deleting it.
Spam protection
When enabled (default), NBForms automatically analyses every incoming submission for bot and spam signals:
- Empty or bot-like user-agent strings
- Known spam keywords in field values
- Three or more URLs in field values
- Duplicate submissions from the same IP within 60 seconds
- Identical field content submitted within 10 minutes
Flagged submissions are stored with a spam label and excluded from the normal submission count, but they are not deleted. You can review them in the Submissions tab.
Toggle this off if you want all submissions to be accepted as-is — useful when your form is internal-only or you handle filtering yourself.
Form name
The name shown in the dashboard sidebar and in email notification subject lines. Maximum 80 characters.
Description
Optional free-text note for your team. Not shown to submitters.
Notification emails
Add one or more email addresses to receive an alert on every new submission. Type an address and press Enter or Tab to add it. Click the × on a chip to remove it.
The free plan supports one notification address. With credits you can add unlimited addresses.
CC emails
Add one or more addresses to be CC'd on every notification email. CC recipients receive the same message as the primary notification addresses but appear in the CC field rather than To.
Type an address and press Enter or Tab to add it; click × to remove.
Form token
Read-only display of your form token. Use the Copy button to grab it for use in your HTML snippet or API calls.
After submit
Success message
Text displayed to the submitter after a successful submission (when no redirect URL is set). Default: "Thank you for your submission!"
Redirect URL
If set, NBForms redirects the browser to this URL after a successful submission instead of showing the success message. Example: https://example.com/thank-you.
Both fields are optional. If neither is set, NBForms returns a JSON response { "success": true } and the browser handles it however your JavaScript specifies.
CAPTCHA
Protect your form against bot spam. Choose one of three options:
| Option | How it works |
|---|---|
| None | No bot protection. Any POST request with a valid token is accepted. |
| reCAPTCHA v2 | Google's "I'm not a robot" checkbox. NBForms verifies the token server-side. |
| Cloudflare Turnstile | Cloudflare's invisible/managed challenge. NBForms verifies server-side. |
Setting up reCAPTCHA v2
- Go to google.com/recaptcha and create a site using reCAPTCHA v2 → "I'm not a robot" Checkbox.
- Add your domain to the allowed list.
- Copy the Secret Key into the form settings.
- Copy the Site Key and add the widget to your form (see Spam Protection).
Setting up Cloudflare Turnstile
- Go to dash.cloudflare.com → Turnstile and add a site.
- Add your domain, choose a widget mode (Managed recommended).
- Copy the Secret Key into the form settings.
- Copy the Site Key and add the widget to your form (see Spam Protection).
The secret key is stored encrypted and is never exposed to users. It is only used for server-side verification.
Danger zone
Available to the form owner only.
Click Delete this form and then type the form's exact name to confirm. Deletion is permanent — all submissions, integrations, and settings are removed and cannot be recovered.