Limits and retention

What a request can contain

Numbers must be finite (NON_FINITE_NUMBER), and a JSON object may not repeat a top-level key (DUPLICATE_FIELD). A refused request never creates a receipt. Every refusal is on Responses and error codes.

How fast a form can be called

These are the current defaults. They exist to stop abuse, and a normal contact form never gets near them. A refused request is 429 with a Retry-After header. The form and workspace caps count accepted leads only, so a malformed or spam request never spends them.

The per-sender hourly limit across a workspace is lower than both caps, so one sender can never use them up for everyone else. Once a workspace has used its daily cap, only a form that has already accepted 100 or more leads in the current hour is refused. The workspace’s quiet forms keep accepting. A request whose sender address cannot be read shares one bucket, with 10 times the per-sender limits.

Allowed origins

A form can list the sites allowed to post to it. With no list, any page can. With a list, FormParcel checks the request’s Origin header, or its Referer when there is no usable Origin, against it, and refuses a mismatch with 403 (origin not allowed).

• A host such as client.example matches any scheme and port. www.client.example and client.example count as one site, whichever you list.
• An entry with a scheme, such as https://client.example:8443, must match scheme, host and port.
• A wildcard such as *.client.example matches the domain and all its subdomains. A wildcard over a shared host or a public suffix, such as *.github.io, *.netlify.app or *.co.uk, is refused when you save it and ignored when matching, because it would admit every site on that host.
• Origin: null comes from sandboxed frames, local files and sites that hide their referrer. With no list it is accepted. With a list, the Referer decides, and a request with neither is refused.

FormParcel counts the posts it refuses for their origin, and the leads it accepts from a page with a hidden origin, and shows both on the form’s settings, so you can tell when a real visitor was turned away. The same list decides which redirect addresses are trusted: Special fields.

What is stored about the page

A receipt keeps the request’s Origin (up to 255 characters) and the Referer as origin and path only (up to 512 characters), without its query string or fragment, which can carry personal data. Both are cleared together with the lead content at the retention purge.

What you must not collect

Do not use FormParcel to collect passwords, payment card numbers or highly sensitive regulated information. Forms accept text only. As a safeguard, a post is refused with HTTP 422, PROHIBITED_FIELD when a field is named like one of these, whatever its letter case or punctuation, at the top level or as a nested JSON key:

password, passwd, pwd, passcode, otp, cvv, cvc, card number, cc number, credit card, debit card, card cvv, ssn

The match is on the whole name, so ordinary fields such as pincode and passport are fine. This check stops honest mistakes and automated misuse. It does not promise that a form carries nothing sensitive, and you stay responsible for what your forms collect. See the terms and the security page. The other fields FormParcel drops or refuses are on Special fields.

How long lead content is kept

• Lead content that was delivered is deleted 7 days after the lead was accepted.
• Lead content that has not been delivered is kept for up to 30 days, so you can fix the problem and retry. After that its content is deleted and the lead can no longer be sent.
• The receipt stays. It holds status, times and attempts, and no lead content. How long the dashboard lists it is the plan’s receipt history, in plan limits below.
• Your Google Sheet keeps its own copy of every delivered lead for as long as you keep it.

You can also delete one lead’s content yourself from its receipt. The receipt and the evidence of every delivery that already happened stay. More on receipts and on the security page.

Sending email

Email recipients are limited per form by plan. A form can have 1 notification recipient on Free, 3 on Starter and 10 on Agency. An address that bounced takes no place. Each email destination sends at most 60 messages an hour and 300 a day. Above that, leads wait and are sent later. Nothing is dropped. Limits set by the email provider work the same way. The auto-reply to visitors has its own daily limits, on Auto-reply.

Bot check and spam check

Every form runs FormParcel’s bot check. A proof is accepted for 30 minutes after its challenge was issued, no sooner than 2 seconds after it, and once. A submission without a valid proof is not refused: it waits in the Spam folder, is not delivered and is not counted. The challenge endpoint answers 30 requests a minute per sender, with the same 429 and Retry-After as the other limits. See the bot check.

When a client site has the Turnstile check on, a visitor who does not pass it is refused with status 403 and the code SPAM_CHECK_FAILED. If Cloudflare cannot answer, the lead is still accepted. See Spam protection.

Plan limits

On top of the limits above, each plan has limits on volume and on how many client sites it covers. They are enforced. Receipts, automatic retries and repair are the same on every plan.

• Each plan has a monthly limit on leads: 50 on Free, 1,000 on Starter and 10,000 on Agency, where the volume is shared across all client sites. A month is a UTC calendar month. Spam and dashboard test leads are not counted.
• A month's lead limit is the highest your plan allowed at any point that month: an upgrade lifts it at once, and a downgrade applies from the next month.
• Free includes one site with two forms, Starter 3 sites and Agency 25 sites. Starter and Agency do not cap the number of forms. Archived sites and forms do not count.
• The one site on the Free plan is the one created for you when you sign up, so an agency that adds its clients' sites needs Starter or Agency.
• Receipt history is 30 days on the Free plan and 1 year on Starter and Agency. Older delivered receipts are hidden, not deleted, and a receipt that needs action is always shown.
• Site, form, Sheet and recipient limits follow your current plan at once, and a lower plan deletes nothing: you keep what you have and cannot add more than the plan allows.

Over the monthly limit

• Going over your monthly limit does not stop delivery. Until a workspace has used three times its limit, every lead is still stored and delivered to your Sheet and by email.
• A lead counted past the monthly limit gets no auto-reply. The lead and the owner's emails carry on.
• At three times the limit, the form refuses new leads for the rest of the month. The visitor is told plainly that their message was not accepted. A refused lead is not saved and has no receipt. A script that posts to a form in that state gets HTTP 429 with the code PLAN_LIMIT_REACHED and no Retry-After header, because waiting a few seconds changes nothing. See PLAN_LIMIT_REACHED.
• Spam is not counted toward your limit.

{
  "success": false,
  "error": "This form cannot take more messages this month. Please contact the business another way.",
  "code": "PLAN_LIMIT_REACHED"
}

The plans and prices are on the pricing page.