---
title: "Limits and retention"
description: "What a form accepts, how fast it can be called, which pages may post to it, what each plan allows, what you must not collect and how long lead content is kept."
url: "https://formparcel.live/docs/reference/limits"
---

# Limits and retention

What a form accepts, how fast it can be called, which pages may post to it, what each plan allows, what you must not collect and how long lead content is kept.

## What a request can contain

| Limit | Value | If it is exceeded |
| --- | --- | --- |
| Request body | 16 KB | HTTP 413, [`PAYLOAD_TOO_LARGE`](https://formparcel.live/docs/reference/responses#payload-too-large) |
| Fields in one post | 50 | HTTP 400, [`TOO_MANY_FIELDS`](https://formparcel.live/docs/reference/responses#too-many-fields) |
| Length of a field name | 64 characters | HTTP 400, [`FIELD_NAME_TOO_LONG`](https://formparcel.live/docs/reference/responses#field-name-too-long) |
| Length of a field value | 4,096 characters. For a list or an object, the length of its JSON. | HTTP 400, [`FIELD_VALUE_TOO_LONG`](https://formparcel.live/docs/reference/responses#field-value-too-long) |
| JSON nesting | 4 levels in total | HTTP 400, [`PAYLOAD_TOO_DEEP`](https://formparcel.live/docs/reference/responses#payload-too-deep) |
| Content types | `application/x-www-form-urlencoded`, `multipart/form-data`, `application/json` | HTTP 415, [`UNSUPPORTED_MEDIA_TYPE`](https://formparcel.live/docs/reference/responses#unsupported-media-type) |
| Charset | UTF-8. A URL-encoded form in another declared charset is decoded as that charset. | HTTP 415, [`UNSUPPORTED_CHARSET`](https://formparcel.live/docs/reference/responses#unsupported-charset) (JSON and multipart) |
| Files | Not accepted | HTTP 400, [`FILE_UPLOAD_NOT_SUPPORTED`](https://formparcel.live/docs/reference/responses#file-upload-not-supported) |
| Content | At least one field with a value a person could read | HTTP 400, [`EMPTY_SUBMISSION`](https://formparcel.live/docs/reference/responses#empty-submission) |

Numbers must be finite ([`NON_FINITE_NUMBER`](https://formparcel.live/docs/reference/responses#non-finite-number)), and a JSON object may not repeat a top-level key ([`DUPLICATE_FIELD`](https://formparcel.live/docs/reference/responses#duplicate-field)). A refused request never creates a receipt. Every refusal is on [Responses and error codes](https://formparcel.live/docs/reference/responses).

## How fast a form can be called

These are the current defaults. They exist to stop abuse, and a normal contact form never gets near them. A refused request is 429 with a `Retry-After` header. The form and workspace caps count accepted leads only, so a malformed or spam request never spends them.

| Limit | Default | Code |
| --- | --- | --- |
| One sender, one form | 10 requests a minute | [`FORM_RATE_LIMITED`](https://formparcel.live/docs/reference/responses#form-rate-limited) |
| One sender, all forms | 120 requests a minute | [`CLIENT_RATE_LIMITED`](https://formparcel.live/docs/reference/responses#client-rate-limited) |
| One sender, one workspace | 30 requests an hour | [`CLIENT_HOURLY_LIMIT`](https://formparcel.live/docs/reference/responses#client-hourly-limit) |
| One sender, one workspace | 10 requests a day | Further submissions are held in the Spam folder, not refused |
| One form, all senders | 1,000 accepted leads an hour | [`FORM_HOURLY_LIMIT`](https://formparcel.live/docs/reference/responses#form-hourly-limit) |
| One workspace, all forms | 10,000 accepted leads a day | [`WORKSPACE_DAILY_LIMIT`](https://formparcel.live/docs/reference/responses#workspace-daily-limit) |
| One sender, bot check challenges | 30 requests a minute | [`CLIENT_RATE_LIMITED`](https://formparcel.live/docs/reference/responses#client-rate-limited) |

The per-sender hourly limit across a workspace is lower than both caps, so one sender can never use them up for everyone else. Once a workspace has used its daily cap, only a form that has already accepted 100 or more leads in the current hour is refused. The workspace’s quiet forms keep accepting. A request whose sender address cannot be read shares one bucket, with 10 times the per-sender limits.

## Allowed origins

A form can list the sites allowed to post to it. With no list, any page can. With a list, FormParcel checks the request’s `Origin` header, or its `Referer` when there is no usable Origin, against it, and refuses a mismatch with 403 ([origin not allowed](https://formparcel.live/docs/reference/responses#origin-not-allowed)).

- A host such as `client.example` matches any scheme and port. `www.client.example` and `client.example` count as one site, whichever you list.
- An entry with a scheme, such as `https://client.example:8443`, must match scheme, host and port.
- A wildcard such as `*.client.example` matches the domain and all its subdomains. A wildcard over a shared host or a public suffix, such as `*.github.io`, `*.netlify.app` or `*.co.uk`, is refused when you save it and ignored when matching, because it would admit every site on that host.
- `Origin: null` comes from sandboxed frames, local files and sites that hide their referrer. With no list it is accepted. With a list, the Referer decides, and a request with neither is refused.

FormParcel counts the posts it refuses for their origin, and the leads it accepts from a page with a hidden origin, and shows both on the form’s settings, so you can tell when a real visitor was turned away. The same list decides which redirect addresses are trusted: [Special fields](https://formparcel.live/docs/reference/fields#redirects).

## What is stored about the page

A receipt keeps the request’s `Origin` (up to 255 characters) and the `Referer` as origin and path only (up to 512 characters), without its query string or fragment, which can carry personal data. Both are cleared together with the lead content at the retention purge.

## What you must not collect

Do not use FormParcel to collect passwords, payment card numbers or highly sensitive regulated information. Forms accept text only. As a safeguard, a post is refused with HTTP 422, [`PROHIBITED_FIELD`](https://formparcel.live/docs/reference/responses#prohibited-field) when a field is named like one of these, whatever its letter case or punctuation, at the top level or as a nested JSON key:

`password`, `passwd`, `pwd`, `passcode`, `otp`, `cvv`, `cvc`, `card number`, `cc number`, `credit card`, `debit card`, `card cvv`, `ssn`

The match is on the whole name, so ordinary fields such as `pincode` and `passport` are fine. This check stops honest mistakes and automated misuse. It does not promise that a form carries nothing sensitive, and you stay responsible for what your forms collect. See the [terms](https://formparcel.live/terms) and the [security page](https://formparcel.live/security). The other fields FormParcel drops or refuses are on [Special fields](https://formparcel.live/docs/reference/fields).

## How long lead content is kept

- Lead content that was delivered is deleted 7 days after the lead was accepted.
- Lead content that has not been delivered is kept for up to 30 days, so you can fix the problem and retry. After that its content is deleted and the lead can no longer be sent.
- The receipt stays. It holds status, times and attempts, and no lead content. How long the dashboard lists it is the plan’s receipt history, in [plan limits](https://formparcel.live/docs/reference/limits#plan-limits) below.
- Your Google Sheet keeps its own copy of every delivered lead for as long as you keep it.

You can also delete one lead’s content yourself from its receipt. The receipt and the evidence of every delivery that already happened stay. More on [receipts](https://formparcel.live/docs/reference/receipts#retention) and on the [security page](https://formparcel.live/security).

## Sending email

Email recipients are limited per form by plan. A form can have 1 notification recipient on Free, 3 on Starter and 10 on Agency. An address that bounced takes no place. Each email destination sends at most 60 messages an hour and 300 a day. Above that, leads wait and are sent later. Nothing is dropped. Limits set by the email provider work the same way. The auto-reply to visitors has its own daily limits, on [Auto-reply](https://formparcel.live/docs/setup/autoresponder).

## Bot check and spam check

Every form runs FormParcel’s bot check. A proof is accepted for 30 minutes after its challenge was issued, no sooner than 2 seconds after it, and once. A submission without a valid proof is not refused: it waits in the Spam folder, is not delivered and is not counted. The challenge endpoint answers 30 requests a minute per sender, with the same 429 and `Retry-After` as the other limits. See [the bot check](https://formparcel.live/docs/setup/spam-protection#the-bot-check).

When a client site has the Turnstile check on, a visitor who does not pass it is refused with status 403 and the code [`SPAM_CHECK_FAILED`](https://formparcel.live/docs/reference/responses#spam-check-failed). If Cloudflare cannot answer, the lead is still accepted. See [Spam protection](https://formparcel.live/docs/setup/spam-protection).

## Plan limits

On top of the limits above, each plan has limits on volume and on how many client sites it covers. They are enforced. Receipts, automatic retries and repair are the same on every plan.

| Limit | Free | Starter | Agency |
| --- | --- | --- | --- |
| Leads per month | 50 | 1,000 | 10,000 |
| Client sites | 1 site, 2 forms | 3 sites | 25 sites |
| Google Sheets delivery | 1 Sheet | Included | Included |
| Receipt history | 30 days | 1 year | 1 year |
| Notification recipients per form | 1 | 3 | 10 |

- Each plan has a monthly limit on leads: 50 on Free, 1,000 on Starter and 10,000 on Agency, where the volume is shared across all client sites. A month is a UTC calendar month. Spam and dashboard test leads are not counted.
- A month's lead limit is the highest your plan allowed at any point that month: an upgrade lifts it at once, and a downgrade applies from the next month.
- Free includes one site with two forms, Starter 3 sites and Agency 25 sites. Starter and Agency do not cap the number of forms. Archived sites and forms do not count.
- The one site on the Free plan is the one created for you when you sign up, so an agency that adds its clients' sites needs Starter or Agency.
- Receipt history is 30 days on the Free plan and 1 year on Starter and Agency. Older delivered receipts are hidden, not deleted, and a receipt that needs action is always shown.
- Site, form, Sheet and recipient limits follow your current plan at once, and a lower plan deletes nothing: you keep what you have and cannot add more than the plan allows.

### Over the monthly limit

- Going over your monthly limit does not stop delivery. Until a workspace has used three times its limit, every lead is still stored and delivered to your Sheet and by email.
- A lead counted past the monthly limit gets no auto-reply. The lead and the owner's emails carry on.
- At three times the limit, the form refuses new leads for the rest of the month. The visitor is told plainly that their message was not accepted. A refused lead is not saved and has no receipt. A script that posts to a form in that state gets HTTP 429 with the code PLAN_LIMIT_REACHED and no Retry-After header, because waiting a few seconds changes nothing. See [`PLAN_LIMIT_REACHED`](https://formparcel.live/docs/reference/responses#plan-limit-reached).
- Spam is not counted toward your limit.

FormParcel emails the workspace owner when usage reaches 80% of the monthly limit, again when the limit is used up, and when a form starts refusing leads. Each email goes out once a month for the limit in force.

```json title="Refusal at three times the limit"
{
  "success": false,
  "error": "This form cannot take more messages this month. Please contact the business another way.",
  "code": "PLAN_LIMIT_REACHED"
}
```

The plans and prices are on the [pricing page](https://formparcel.live/pricing).