# Spam protection and files

This page covers the **Forms settings** that apply to every form, the ways Borkol keeps spam out of your inbox, and what happens to the files visitors upload.

## Forms settings

Open **Inbox** → **Settings** in the sidebar. The **Forms settings** page has three boxes. They have no Save button of their own: as soon as you change something, a bar with **Unsaved changes**, **Discard changes** and **Save** appears at the bottom of the screen (see [Saving changes](/docs/workspace/settings#saving-changes)). After **Save**, **Saved.** appears at the top of the page.

### Notifications

**Default recipients**: up to ten email addresses that get an email for every new submission of a form that has no addresses of its own (see [Notifications](/docs/forms/index#notifications)). Type an address and click **Add**. Leave the list empty to send to your business email.

### Cloudflare Turnstile

[Cloudflare Turnstile](https://www.cloudflare.com/products/turnstile/) is an invisible check that stops bots. You need a Cloudflare account for the keys. Every form that has Turnstile switched on uses the keys you enter here.

1. Click **Get your keys in the Cloudflare dashboard**, add a Turnstile widget for your site's domain and copy its two keys.
2. Paste the **Site key** ("Public: your site shows it in the widget.").
3. Paste the **Secret key**. It is stored encrypted and never shown again: after you save, the field stays empty and shows **Secret set**. Leave it blank to keep the stored secret, type a new one to replace it, or click **Remove** to delete it when you save.
4. Click **Save** in the bar at the bottom of the screen.

The box shows **Ready** when both keys are set, and **Not set up** otherwise.

### Active forms with Turnstile on

This box lists your active forms that have Turnstile switched on; click one to open it. When the keys above are missing, it warns "These forms are not checked yet: add both keys above." When no active form has Turnstile on, it says so: turn it on per form under **Settings** → **Spam protection** in the form editor. Forms with Turnstile off accept submissions without the check.

## How forms keep spam out

Three protections work together. Each form has its own settings on its **Settings** tab under **Spam protection** (see [Spam protection](/docs/forms/index#spam-protection)).

| Protection | Where you set it | What it does |
| --- | --- | --- |
| Hidden trap field | Nothing to set: your site adds it | Your site adds an input people never see. Bots tend to fill every input, and a submission with that input filled is answered as if it succeeded, but nothing is stored and nobody is notified. |
| **Submissions per visitor** | Per form, 1 to 100 per hour (5 by default) | One visitor cannot send the form more often than this. Attempts with mistakes count too. |
| **Cloudflare Turnstile** | Switch per form, keys in **Forms settings** | The visitor passes an invisible check before sending; submissions that fail it are refused. |

**Turnstile needs both keys.** When a form has **Cloudflare Turnstile** switched on but **Forms settings** has no site key or no secret key, your site shows no check and submissions are **not** verified. The form's **Settings** tab warns you about this ("Turnstile is on, but your Forms settings have no site key and secret yet...") and **Active forms with Turnstile on** marks those forms.

Turnstile also needs your site to show the widget: your developer finds the details on the form's **Use on your site** tab and in the [Forms API reference](/api/forms/index#turnstile). When a visitor fails the check, Borkol refuses the submission with "The spam check failed. Reload the page and try again."

Submissions that slip through anyway can be marked **Spam** in the [Inbox](/docs/forms/inbox#statuses).

## Files

A **File upload** question (see [File uploads](/docs/forms/designer#file-uploads)) lets visitors attach images or PDFs.

- **What is accepted**: the types you tick under **Accepted files** (**Images**: JPEG, PNG, WebP and HEIC; **PDF**), up to **Max files** files of at most **Max MB per file** each (20 MB at most). Borkol checks each file by its content, so a renamed file of another type is refused ("This file type is not accepted here."), and so is a file that is too large ("The file may not be larger than 10 MB.", for example).
- **Upload limit**: a visitor can upload at most 30 files per form per hour.
- **When files arrive**: the visitor's files are uploaded while they fill in the form and become part of the submission when they send it. Files of a form that was never sent are deleted by a daily cleanup once they are more than 24 hours old.
- **Where they are**: with the submission in your [Inbox](/docs/forms/inbox#files). They are private: not in your media library, with no public address. Opening one creates a link that works for 5 minutes.
- **When they are deleted**: when you delete a submission, its files are erased for good with it after 30 days.