Spam protection and files

This page covers the Forms settings that apply to every form, the ways Borkol keeps spam out of your inbox, and what happens to the files visitors upload.

Forms settings#

Open Inbox → Settings in the sidebar. The Forms settings page has three boxes. They have no Save button of their own: as soon as you change something, a bar with Unsaved changes, Discard changes and Save appears at the bottom of the screen (see Saving changes). After Save, Saved. appears at the top of the page.

Notifications#

Default recipients: up to ten email addresses that get an email for every new submission of a form that has no addresses of its own (see Notifications). Type an address and click Add. Leave the list empty to send to your business email.

Cloudflare Turnstile#

Cloudflare Turnstile is an invisible check that stops bots. You need a Cloudflare account for the keys. Every form that has Turnstile switched on uses the keys you enter here.

1. Click Get your keys in the Cloudflare dashboard, add a Turnstile widget for your site's domain and copy its two keys.
2. Paste the Site key ("Public: your site shows it in the widget.").
3. Paste the Secret key. It is stored encrypted and never shown again: after you save, the field stays empty and shows Secret set. Leave it blank to keep the stored secret, type a new one to replace it, or click Remove to delete it when you save.
4. Click Save in the bar at the bottom of the screen.

The box shows Ready when both keys are set, and Not set up otherwise.

Active forms with Turnstile on#

This box lists your active forms that have Turnstile switched on; click one to open it. When the keys above are missing, it warns "These forms are not checked yet: add both keys above." When no active form has Turnstile on, it says so: turn it on per form under Settings → Spam protection in the form editor. Forms with Turnstile off accept submissions without the check.

How forms keep spam out#

Three protections work together. Each form has its own settings on its Settings tab under Spam protection (see Spam protection).

Turnstile needs both keys. When a form has Cloudflare Turnstile switched on but Forms settings has no site key or no secret key, your site shows no check and submissions are not verified. The form's Settings tab warns you about this ("Turnstile is on, but your Forms settings have no site key and secret yet...") and Active forms with Turnstile on marks those forms.

Turnstile also needs your site to show the widget: your developer finds the details on the form's Use on your site tab and in the Forms API reference. When a visitor fails the check, Borkol refuses the submission with "The spam check failed. Reload the page and try again."

Submissions that slip through anyway can be marked Spam in the Inbox.

Files#

A File upload question (see File uploads) lets visitors attach images or PDFs.

• What is accepted: the types you tick under Accepted files (Images: JPEG, PNG, WebP and HEIC; PDF), up to Max files files of at most Max MB per file each (20 MB at most). Borkol checks each file by its content, so a renamed file of another type is refused ("This file type is not accepted here."), and so is a file that is too large ("The file may not be larger than 10 MB.", for example).
• Upload limit: a visitor can upload at most 30 files per form per hour.
• When files arrive: the visitor's files are uploaded while they fill in the form and become part of the submission when they send it. Files of a form that was never sent are deleted by a daily cleanup once they are more than 24 hours old.
• Where they are: with the submission in your Inbox. They are private: not in your media library, with no public address. Opening one creates a link that works for 5 minutes.
• When they are deleted: when you delete a submission, its files are erased for good with it after 30 days.