What happens to every submission

The path of one submission

1. Checked

   The form must exist, the request must be under 100 KB, and the sending site must pass the form’s domain whitelist (if you set one). Otherwise it is refused with a clear error and nothing is stored.

2. Stored

   The submission is inserted into the database (Cloudflare D1). Only after that insert succeeds does the visitor get “Thanks”, a redirect, or {"ok":true,"id":"s_…"} for JSON requests.

3. Delivered

   Every enabled destination on the form (email, Telegram, webhook, Sheets and so on) is attempted after the response is sent. A slow or broken destination never delays the visitor and never touches the stored copy.

4. Logged

   Each attempt, success or failure, is recorded in the form’s delivery log with the HTTP status and the error text.

5. Alerted

   On the first failure, FormRill emails the account owner one message naming the submission and each failed destination with its error. If every automatic retry fails too, you get one more “gave up” email.

6. Retried

   A failed delivery is retried automatically about 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours and 12 hours after it fails: six automatic attempts over about a day. You can also press Retry now in the delivery log at any time, for example right after fixing the cause (a wrong webhook URL, a revoked Telegram bot). Spam is never retried.

If the write fails

If the database insert fails, the request errors and the visitor does not see “Thanks”: they get a server error instead of a false success. Fetch-based forms receive a non-2xx response, so your page can show its own message and let them try again. Plain HTML forms show the browser’s error page. We don’t queue a submission anywhere else when the database is down, so a visitor who sees an error should resubmit.

Spam caught by the honeypot

The hidden botcheck field is the honeypot. If it is filled in, the submission is kept in the Spam folder in your dashboard instead of being delivered: it is not emailed and no automation runs, but you can still open it if a real person got caught. A real visitor never sees the field. If a real person gets this error, see troubleshooting: it usually means an autofill tool ticked the box, or the field isn’t hidden.

File uploads aren’t supported yet

Going over your plan limit

Going over your limit never loses a lead. We keep accepting and storing every submission, email you at 80% and 100%, and give you 7 days to upgrade before new ones are held.

Billing and plan limits are not switched on during the beta, so nothing is held back today.

Where it runs

The API runs on Cloudflare Workers and submissions live in Cloudflare D1, so there is no server of ours to restart or run out of disk. Form IDs are 128-bit and unguessable, and a form URL can only submit; reading submissions needs a separate token. More in Security, and every response and status code is in the API reference.

What isn’t covered yet

• Files. Submissions with a file are refused, as above.
• Deliveries failing for more than a day. Automatic retries stop after the sixth attempt; the submission stays stored and you can still press Retry now in the delivery log.
• Uptime figures. We publish none because none exist yet: there is no public status page or uptime history, and no SLA.
• Email arriving in the inbox. We hand the message to our email provider; whether your mailbox accepts it or files it as spam is outside our control. The submission is always in the dashboard.
• Webhook authenticity. Webhook requests are not signed yet.
• Writes during a database outage. See “If the write fails”: the visitor gets an error and must resubmit.