Protection | Form Bastion

Choose the source mode

HTML sources are for public browser forms. Their public keys identify a source and must be assumed visible. Server sources add a source-specific secret that belongs only on a trusted server. Never put that secret in browser code.

Publish your validation rules

Define required fields, accepted types, and maximum lengths in your form draft. Supported field types include text, email, number, and URL. Decide whether fields outside the configured schema should be rejected. Save your draft before publishing. The editor protects unsaved changes and disables publication until the draft is saved. Publish the saved draft to make the rules active.

Client-side HTML validation improves the form experience but does not replace server enforcement. Reserved metadata cannot change the workspace, configured destinations, or action credentials.

Honeypot quarantine

The default honeypot field is _gotcha. Legitimate users should leave it empty. A non-empty value is stored in quarantine, with no normal processing until an authorized customer reviews and releases it.

Rate limits and bounded input

Source-level rate limits and bounded field/file sizes limit resource use. Rate controls use the local Form Bastion protection foundation. They are useful controls, not a promise to detect every abusive submission.

Allowed origins

Configure the origins permitted to use a browser source when your integration needs origin checks and CORS. Origins include scheme and hostname, and a port when applicable. A browser origin restriction is not server authentication; non-browser clients can construct their own headers.

Keep secrets in the right place

Workspace API keys belong in server-side integrations.
Server-source secrets authenticate that source, not the management API.
Webhook signing secrets belong only in the configured action and receiving server.
Account passwords, MFA secrets, and recovery codes are never form fields.