Home / Facts
Reference
The facts, generated from the running service.
Every number below comes from the same configuration the endpoint reads, so this page cannot drift from behaviour. The machine-readable version is /facts.json ; the whole corpus in one file is /llms-full.txt .
Ingest endpoint
Property Value method and path POST https://freelyform.com/f/:formIdThe form id is public; it is not a secret. accepted payloads application/x-www-form-urlencoded, multipart/form-data, application/json request body limit 65,536 bytes rate limit 120 requests per 1 minute, per form and client IPKeyed on the client address from CF-Connecting-IP, not on the proxy hop. response formats HTML success page, redirect, or JSON when the client sends Accept: application/json
Storage and retention
Property Value every submission is stored first yes — before any delivery is attempted archive expiry none on any tier attachment retention 90 days by default, configurable per form export CSV per form, filterable by status; management API for the same data deletion per submission, including its attachments
File uploads
Property Value files per submission 5 by default, configurable 1–10 per form size per file 25 MB, also capped by the form’s own setting content policy MIME type and extension allowlist; images, PDF, text, Office documents and ZIP tier requirement Personal and above; the free tier refuses uploads with 402 uploads_require_plan
Delivery
Property Value channels owner email, autoresponse to the submitter, webhook (HTTP, Discord, Telegram) per-channel records one status per channel, with provider message id and error text recipient requirement owner addresses must be confirmed; an unconfirmed address leaves the submission pending_verification webhook attempts 5, with backoff, then recorded as failed webhook signature HMAC-SHA256 over `.`, header x-freelyform-signature: t=,v1= replay a failed webhook delivery can be replayed from the dashboard or the API suppression hard bounces and complaints are suppressed per account, before the next send
Spam classification
Property Value verdict threshold score ≥ 100 time trap submissions arriving within 2000 ms of the page render link flood more than 2 URLs in the payload vocabulary signals 15 junk phrases and 8 disposable mail domains what happens to a spam verdict stored with status spam and the reasons attached; never delivered, never counted against the allowance captcha optional per form (Cloudflare Turnstile); off by default on new forms
Allowance and over-limit behaviour
Property Value allowance source per-account override, otherwise the plan’s monthly submission count over the allowance submissions are stored as over_limit, no notification is sent, nothing is counted visitor experience over the allowance identical to a normal success — visitors are never rejected for the owner’s quota reprocessing held submissions can be reprocessed once there is room; that counts them and sends the notification excluded from the count spam verdicts and unfinished drafts usage notices emails at 50%, 75%, 90% and 100% of the allowance, once each per period
Plans
Plan Submissions / month Monthly Yearly Yearly per month Free 80 $0 $0 $0 Personal 300 $12 $96 $8 Professional 2,500 $24 $192 $16 Business 30,000 $72 $576 $48 Custom custom quoted — —
Billing is not enabled: no tier is charged today, and the monthly allowance still applies.
What each tier unlocks
Capability Included from Forms per account free Submission archive free Spam controls: honeypot, heuristics, Turnstile free Email notifications with delivery records free Autoresponse to the submitter free Custom redirect after submit free REST API and CSV export free File uploads (5 × 25 MB per submission) personal Rules: require, route, block professional Signed webhooks with retries and replay professional Priority support by email professional Your own sending domain over SMTP business Deliverability dashboard, bounces and suppressions business Written SLA and named contact custom
Control fields
Field Effect _gotchaHoneypot. A filled value is stored as spam, never delivered. _tsPage render timestamp in epoch milliseconds; enables the time trap. _redirectWhere to send the visitor after a successful submission. _subjectOverrides the notification subject for this submission. _replytoSets the reply-to address on the notification. _partialSave a draft and return a resume link instead of delivering. _resumeResume a draft with its token; the completed answers merge into the original record. _idempotencyClient-supplied key; a repeat with the same key returns the existing record. cf-turnstile-responseCaptcha token, required only on forms with captcha enabled.
Ingest error codes
Code HTTP Meaning form_not_found404 No active form with that id, or the account is suspended. origin_not_allowed403 The Origin header is not in the form’s allowlist. invalid_submission400 The payload could not be parsed into fields. turnstile_required400 The form requires a captcha token and none was sent. turnstile_failed403 A captcha token was sent but did not verify. rule_rejected422 A require rule failed, or a block rule matched. partial_not_enabled400 A draft was sent to a form that does not accept drafts. resume_not_found404 The resume token is invalid, consumed, or expired. already_completed409 The draft was already completed; its resume token was used. uploads_not_enabled400 Files were attached to a form that does not accept them. uploads_require_plan402 The owning account is on a tier without file uploads. uploads_require_complete_submission400 Files were attached to a draft or a resume. too_many_files400 More files than the form allows in one submission. upload_too_large413 A file exceeds the form’s per-file limit. upload_type_not_allowed400 A file’s type or extension is not on the allowlist. quota_exceeded429 Legacy hard-stop path. Current behaviour stores the submission as over_limit instead.
What this service does not provide
team roles and multi-user accounts a marketplace of third-party integrations (Sheets, Slack, Zapier, CRM) card payments on a form AI triage of submissions e-signature SSO a public status page a published uptime SLA claims about delivery rates, customer counts, or revenue No uptime percentage, delivery rate, or customer count is published anywhere on this site, because none of them can be verified by a reader.
Put your forms on a backend that keeps a record.
Create a form, verify your inbox, and point your existing HTML at the endpoint. No server, no SDK, no rewrite.
One action attribute · urlencoded, JSON, or multipart · no SDK, no build step