Limits that protect a public form

The spam check, how many sends a form takes an hour from one address and in all, file sizes, line counts, e-mail caps and the closing date.

A form anyone can open is a way for strangers to write into your tables. Every form is guarded, from the moment it is published, by a spam check and by hourly ceilings worked out from one setting, Per hour. You do not have to turn anything on.

The one setting: Per hour

Select the top of the form in the builder (or choose Change beside Protected in the Publish sheet). Per hour is how many sends the form takes from one address in an hour: any whole number from 1 to 10,000. Left empty, it is 20. The line under it says the most the form takes in an hour in all, which the same number decides.

The limits

Limit	How much	Who it applies to
Spam check	A send that fills in a box people never see, or comes less than 3 seconds after the form opened, is refused.	Everyone who cannot edit the form.
Sends from one address	Per hour (20 unless you change it). Every attempt counts, including refused ones.	Everyone, editors included.
Sends in all	10 times Per hour, never fewer than 200 and never more than 10,000. 200 at the default.	Everyone who cannot edit the form. People outside the workspace and members are counted apart, so a flood from outside does not close the form to your team.
Records the form adds	New records added by an answer typed and not found, such as a new customer: 1.5 times Per hour, never fewer than 30. 30 at the default.	As for sends in all.
Files	Up to 10 MB each: photos (JPEG, PNG, GIF, WebP, HEIC), PDF, text, CSV, Word and Excel files. Up to 10 times Per hour files from one address an hour. A file uploaded and never sent is removed after 24 hours.	Everyone.
Lines	200 per section unless you set At most, which goes up to 1,000.	Everyone.
Changes to a response	20 per response. Each change also counts toward the hourly limits above.	The person changing it through their link.
Copies e-mailed to the person	An hour: 5 to one address from one form, 10 to one address from all the workspace's forms, 100 from the workspace in all.	Every send that asks for a copy.
Notes to your team	An hour: 30 to one address, 60 from the workspace in all. The last one the hour allows says the rest are in Responses.	Every send.

An hour is a clock hour: the counts start again at the top of each hour, not an hour after the first send. The form's editors (who may change it, including workspace admins) skip the spam check and are not counted toward sends in all or records added, so a flood never locks out the people who run the form.

A refused send writes nothing. A team note or a copy over its cap is not sent, but the send itself is written: every order that came in is in Responses.

What people are told

Spam check: a short message to wait a moment and send again, the same for both checks, so a script learns nothing. A person who tripped it by accident succeeds on the next try.
Sends from one address: that the form has had a lot of answers from their connection in the last hour, and to try again later.
Sends in all, or records added: the form shows its closed screen, with your headline from What they read when it is closed, that the form has had a lot of answers in the last hour, and how many minutes until it opens again. A form already at its limit shows this screen when it opens, before anyone fills it in. Your page list shows the form as "closed until the next hour".

A send refused because a price changed while the form was open is given back once an hour, so asking the person to check and send again does not use up their hour.

Closing date

Select the top of the form and set Closes to a date and time, or turn on Stops working on a date in the Publish sheet. From that moment, by the server's clock, the form refuses sends and shows its closed screen with your line from What they read when it is closed. Never close clears the date.

Addresses are counted by a scrambled code that changes every hour and differs from form to form. The address itself is never stored.