Fields
Add fields in the Form Fields repeater. Types: Text, Email, Textarea, URL, Tel, Radio, Select, Checkbox, Acceptance, Number, Date, Time, File Upload, Password, reCAPTCHA, reCAPTCHA v3, hCaptcha, HTML, Hidden and Step. Per field: label, placeholder, required, options (one per line,Label|value), column width, rows, default value, and an ID. The id is the field’s name in the submission and in email templates: [field id="email"].
File upload fields choose how the file travels: an email with a link (the file stays on the server and is listed with the submission), an email with the file attached (the file is not kept), or both. Maximum size defaults to 1 MB; allowed types default to the site’s.
Input masks on text and telephone fields: international telephone, phone in several formats, date and time, money with separators and a prefix, credit card, IP address. Masks are checked again on the server.
Steps: insert a Step field wherever a page break should be. The Steps Settings section chooses the indicator (number, icon, number and text, icon and text, or a progress bar) and its shape.
Actions after submit
Pick any number. The default is Email and Collect Submissions.
If one action fails, the others still run; the failure is reported to administrators.
Messages and validation
Under Additional Options: a form id, browser or custom validation, and custom success, error, server-error, invalid-form and required-field messages.Spam protection
Every form carries a honeypot: a hidden field a person never fills. A submission that fills it is dropped silently and the visitor sees the success message. Under Bevel → Site Settings → Settings → Forms:- reCAPTCHA v2, reCAPTCHA v3 (with a score threshold, default 0.5) and hCaptcha keys. Add the matching field to a form to use one. A page carries one reCAPTCHA flavour.
- Blocked words and addresses, one per line. A submission is refused when any answer contains an entry, or when the visitor’s address starts with one.
- Minimum time to fill, in seconds (up to 60). A form returned faster is refused; the timestamp is signed, so it cannot be faked.
- Keep blocked submissions, on by default: refused submissions land under Submissions → Spam instead of vanishing.
bevel/forms/rate_limit filter changes the number; 0 disables it.
Behind Cloudflare the visitor’s real address is read from Cloudflare’s header. Forwarded-address headers are believed only when the request actually comes from a trusted proxy; Cloudflare’s published ranges are trusted out of the box, and bevel/forms/trusted_proxies adds your own.
Submissions
Bevel → Submissions (anyone who can edit pages) is the inbox: Inbox, Unread, Spam and Trash views, a form selector, a search over the answers, a date range, and mark read, mark unread, trash, restore, spam and not-spam actions, singly or in bulk. Export CSV downloads the current view with one column per field. A form keeps submissions only while Collect Submissions is among its actions.For developers
bevel/forms/field_types adds field types, bevel/forms/actions adds actions, and the bevel/forms/before_actions action fires after validation with the record and the response. See Hooks.