Special fields

Every other field in a post is lead content: it is stored with the lead and becomes a column in the Sheet. These names are different.

Redirects with _next

Put a hidden field named _next in a plain HTML form. Its value is the page the visitor should land on. The older name _redirect is also accepted, and _next wins when both are present.

<input type="hidden" name="_next" value="https://your-site.example/thanks">

When the address is trusted, FormParcel answers a browser form post with a 303 redirect to it, after the lead has been saved. FormParcel reads the field and does not store it or write it to the Sheet. A browser that trips the spam trap, for example through autofill, is sent to the same address, so a person never lands on a dead page.

The trust rule

FormParcel will not redirect to an arbitrary address, because that would let anyone use your form to send visitors to another site. A redirect is followed only when the address is on the client’s own site:

• It is on the site’s domain, the domain you entered for the client site in FormParcel. The scheme, host and port must match.
• Or its host is one of the form’s allowed origins. A wildcard such as *.client.example matches the domain and its subdomains, but not an address with a port, and a wildcard over a shared host such as *.github.io or *.netlify.app is never trusted.
• Or it is a path that starts with /, such as /thanks. It is resolved against the site’s domain, or against the first plain address in the allowed origins, and must stay there.

These are never followed:

• An address with a username or password in it.
• An address that begins with //, or that contains a backslash or a control character.
• Anything that is not http or https, such as javascript: or data:.
• A _next that is repeated. It must appear once.

When the address is not trusted

The lead is still saved. The visitor sees FormParcel’s short confirmation page instead of your thank-you page. If that happens on your own site, check that the client site’s domain is set in FormParcel and matches the address in _next, including https and any www.

fetch never redirects

Anything that is not a browser navigation gets JSON back and no redirect, whatever it sends in _next or _redirect: fetch, XHR, curl, a server calling FormParcel, a JSON body, or Accept: application/json. A script that sends no Accept header gets JSON too. With fetch, you decide what happens next in your own code. See the fetch guide and Responses and error codes.

The spam trap

_gotcha is a field people should never see. Bots tend to fill in every field they find. If it arrives with any value, FormParcel drops the post: nothing is saved and no receipt is created.

• A script gets an empty 204. Show no success message.
• A browser that trips it, for example through autofill, is shown the same page or sent to the same _next address as a real lead, so a person is not left on a page that does nothing.

You can change the trap’s name in the form’s settings. A name that matches a common real field, such as name, email, phone or message, is refused, because it would drop real leads. When the trap has a different name, a field called _gotcha is treated like any other dropped field. How to hide it is on the plain HTML guide.

The bot check proof

FormParcel’s bot check script adds a hidden _fp_proof field to the form. A page that sends with fetch gets the value from window.FormParcel.proof() and sends it as a field of the JSON body. FormParcel checks it and never saves it with the lead or writes it to the Sheet. Without a valid proof, or with one sent a second time, the submission waits in the Spam folder. See Spam protection.

The spam check token

When a client site has the Cloudflare Turnstile check on, the widget adds a cf-turnstile-response field to the form. FormParcel checks it with Cloudflare and never saves it with the lead. A script sends it as a field of the JSON body. See Spam protection.

Dropped fields

Other form services add control and captcha fields to a post. They are instructions or opaque tokens, not lead content, so FormParcel drops them in any letter case: they are not stored, not in the Sheet and not in email.

_gotcha, _captcha, _template, g-recaptcha-response, h-captcha-response, cf-turnstile-response, _fp_proof

Refused names

A post is refused with status 422 (PROHIBITED_FIELD) when a field is named like a password, a one-time code or a card detail. A post with no readable value in any field is refused too (EMPTY_SUBMISSION). Neither creates a receipt. The names, and what you must not collect, are on Limits and retention.

Fields the lead email reads

The owner email uses two of your fields.

• Reply-To. The first field called email, email_address, your_email, mail, contact_email, _replyto, replyto, reply_to, reply-to that holds exactly one plain address becomes the reply address, so replying goes to the visitor.
• Subject. A hidden _subject field adds a single-line suffix to the email subject, up to 80 characters. It is an ordinary field too, so it also appears in the Sheet.

System columns

FormParcel writes four columns of its own into every Sheet it creates: _submission_id, _received_at, _source_site and _source_form. A form field with one of those names is written to a column called custom_ followed by the name, so it never overwrites a system column. What each one holds is on Google Sheets.