> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wpbevel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Forms

> The Form widget, its fields, actions after submit, spam protection and the Submissions inbox.

The **Form** widget builds contact, quote and sign-up forms in the editor. Submissions are emailed, stored in **Bevel → Submissions**, and can be sent on to Mailchimp, Slack, Discord, a webhook or a redirect.

## Fields

Add fields in the **Form Fields** repeater. Types: Text, Email, Textarea, URL, Tel, Radio, Select, Checkbox, Acceptance, Number, Date, Time, File Upload, Password, reCAPTCHA, reCAPTCHA v3, hCaptcha, HTML, Hidden and **Step**.

Per field: label, placeholder, required, options (one per line, `Label|value`), column width, rows, default value, and an **ID**. The id is the field's name in the submission and in email templates: `[field id="email"]`.

**File upload** fields choose how the file travels: an email with a link (the file stays on the server and is listed with the submission), an email with the file attached (the file is not kept), or both. Maximum size defaults to 1 MB; allowed types default to the site's.

**Input masks** on text and telephone fields: international telephone, phone in several formats, date and time, money with separators and a prefix, credit card, IP address. Masks are checked again on the server.

**Steps**: insert a Step field wherever a page break should be. The **Steps Settings** section chooses the indicator (number, icon, number and text, icon and text, or a progress bar) and its shape.

## Actions after submit

Pick any number. The default is **Email** and **Collect Submissions**.

| Action                    | What it does                                                                                                                                                                                               |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Email** and **Email 2** | To, subject, message (default `[all-fields]`), from, reply-to, cc, bcc, HTML or plain. **Branded Layout**, on by default, wraps the message with the site logo, the form's name and the page it came from. |
| **Redirect**              | Send the visitor to a URL; field values can be inserted (`/thanks?name=[field id="name"]`).                                                                                                                |
| **Webhook**               | POST the submission to a URL, optionally with the form name, page and referrer.                                                                                                                            |
| **Mailchimp**             | API key, audience, email and name fields, extra merge fields, tags, double opt-in.                                                                                                                         |
| **Slack**                 | A webhook URL and a message; include the answers and the page.                                                                                                                                             |
| **Discord**               | A webhook URL, a message, and a sender name.                                                                                                                                                               |
| **Collect Submissions**   | Store the submission on the site. **Store Visitor Data** (on) keeps the page, referrer, IP address and browser with it.                                                                                    |

If one action fails, the others still run; the failure is reported to administrators.

## Messages and validation

Under **Additional Options**: a form id, browser or custom validation, and custom success, error, server-error, invalid-form and required-field messages.

## Spam protection

Every form carries a honeypot: a hidden field a person never fills. A submission that fills it is dropped silently and the visitor sees the success message.

Under **Bevel → Site Settings → Settings → Forms**:

* **reCAPTCHA v2**, **reCAPTCHA v3** (with a score threshold, default 0.5) and **hCaptcha** keys. Add the matching field to a form to use one. A page carries one reCAPTCHA flavour.
* **Blocked words and addresses**, one per line. A submission is refused when any answer contains an entry, or when the visitor's address starts with one.
* **Minimum time to fill**, in seconds (up to 60). A form returned faster is refused; the timestamp is signed, so it cannot be faked.
* **Keep blocked submissions**, on by default: refused submissions land under Submissions → Spam instead of vanishing.

The site accepts **10 submissions per address per minute** across all forms. The `bevel/forms/rate_limit` filter changes the number; 0 disables it.

Behind Cloudflare the visitor's real address is read from Cloudflare's header. Forwarded-address headers are believed only when the request actually comes from a trusted proxy; Cloudflare's published ranges are trusted out of the box, and `bevel/forms/trusted_proxies` adds your own.

## Submissions

**Bevel → Submissions** (anyone who can edit pages) is the inbox: **Inbox**, **Unread**, **Spam** and **Trash** views, a form selector, a search over the answers, a date range, and mark read, mark unread, trash, restore, spam and not-spam actions, singly or in bulk. **Export CSV** downloads the current view with one column per field.

A form keeps submissions only while **Collect Submissions** is among its actions.

## For developers

`bevel/forms/field_types` adds field types, `bevel/forms/actions` adds actions, and the `bevel/forms/before_actions` action fires after validation with the record and the response. See [Hooks](/reference/hooks).