Pro Features

Paid controls for busier production forms. FormsFort gates paid features through active Stripe subscriptions or support-managed manual entitlements.

Feature groups

Captcha providers

Choose a provider from form settings, store custom secret keys encrypted when needed, and include the matching browser token field in the form. Managed shared captcha is not available on hosted Free forms. Pro, Business, and lifetime forms can configure reCAPTCHA v2/v3, Cloudflare Turnstile, and hCaptcha with their own provider keys. reCAPTCHA and Turnstile use their provider scripts; hCaptcha can be loaded by the FormsFort helper script.

<!-- reCAPTCHA v2 -->
<script src="https://www.google.com/recaptcha/api.js" async defer></script>
<div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div>

<!-- reCAPTCHA v3 -->
<input type="hidden" name="recaptcha_response" id="recaptcha-response" />

<!-- Cloudflare Turnstile -->
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

<!-- hCaptcha with FormsFort helper script -->
<div class="h-captcha" data-captcha="true"></div>
<script src="https://api.formsfort.com/client/script.js" async defer></script>

CC recipients

Paid/manual forms can copy extra recipients on the queued notification email. Separate multiple addresses with commas or semicolons.

<input type="hidden" name="ccemail" value="[email protected]; [email protected]" />

Autoresponder and intro text

Autoresponders are configured from the dashboard and require a valid submitted email field. Intro text changes the opening line on the recipient notification email.

<input type="email" name="email" required />

Dashboard settings:

• autoresponder enabled
• autoresponder subject
• autoresponder from name
• autoresponder intro text
• include submission copy
• recipient notification intro text

File attachments

Multipart uploads require a paid/manual upload entitlement, form-level count/size/MIME settings, a safe filename extension, and a limited signature check before direct email attachment delivery. They do not use the advanced ClamAV scanner.

<form action="https://api.formsfort.com/submit" method="POST" enctype="multipart/form-data">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input type="file" name="attachment" />
  <button type="submit">Submit</button>
</form>

JavaScript uploads should send FormData directly:

await fetch("https://api.formsfort.com/submit", {
  method: "POST",
  headers: { accept: "application/json" },
  body: new FormData(form),
});

Advanced uploader

The client helper upgrades advanced file inputs, reserves object-storage uploads, writes storage keys back into hidden fields, and blocks submit until uploads finish. The object-storage scan worker requires a clean ClamAV result before the storage key can be submitted. Clean objects are delivered through temporary download links. The generated widget also exposes FilePond-compatible theme hooks for FormsFort uploader CSS.

<form action="https://api.formsfort.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
  <input
    type="file"
    name="attachment"
    data-advanced="true"
    multiple
    accept="image/*, application/pdf"
    data-max-files="3"
    data-max-file-size="5MB"
  />
  <button type="submit">Submit</button>
</form>
<script src="https://api.formsfort.com/client/script.js" async defer></script>

<style>
  .filepond--panel-root {
    background-color: #2c2c2c;
  }
  .filepond--drop-label {
    color: #d4d4d4;
  }
</style>

Webhooks, domains, and server IPs

Webhooks are queued and redacted after successful delivery. Exact allowed domains compare the request Origin or Referer against hostnames configured on the form and are available on Free. Pro, Agency, and Lifetime workspaces can use wildcard domain policies such as *.example.com. Paid/manual controls in this group include webhooks, wildcard domain policies, and server IP safelists.

<input type="hidden" name="webhook" value="https://example.com/formsfort" />

Dashboard settings:

• allowed domains: example.com, www.example.com
• wildcard domain policies: *.example.com for paid/manual workspaces
• server IP safelist for trusted server-side submissions
• form-level webhook endpoint
• webhook delivery retry policy and logs