Rate limits & quotas

The limits that protect forms from abuse, and the per-form controls you set yourself.

A couple of limits keep forms healthy. Most you’ll never notice.

Submission rate limit#

To curb spam and abuse, submissions from a single connection are throttled — about 10 submissions per minute per form, per IP. Beyond that, a respondent briefly sees a “please wait a moment” message. The limiter is designed to fail open: if it can’t run, legitimate submissions still go through. Raw IP addresses aren’t stored — they’re hashed.

Limits you control#

Separately, you can cap or close a form yourself with access control: a maximum number of submissions, a close date, duplicate prevention, and password protection.

Spam protection#

• Honeypot — bots that fill a hidden trap field are silently dropped.
• Origin allow-listing — forms only accept submissions from domains you approve.
• Rate limiting — as above.