Configuration

Name

A label for your own reference. It appears in the dashboard and in the subject line of the notification emails we send. The name has no effect on where submissions go or how they are delivered — it is purely organizational.

Success redirect URL

When a traditional HTML form is submitted successfully, the visitor is redirected here with a 303 response. Set it to a page on your own site — for example a thank-you page. If you leave it blank, the visitor lands on Formcrest's default thank-you page.

This only applies to standard form posts. AJAX submissions that send Accept: application/json receive a JSON response instead of a redirect — see JavaScript (fetch).

Error redirect URL

If a submission is rejected, the visitor is redirected to this URL with an ?error=CODE query parameter appended, where CODE is the stable error code for what went wrong. You can read the parameter on the destination page to show a tailored message.

For example, if your error redirect URL is:

https://example.com/contact

a rejected submission might send the visitor to:

https://example.com/contact?error=domain_not_allowed

The full list of codes you might receive is documented in Error codes. As with the success redirect, this applies to traditional form posts; AJAX clients get the error code in the JSON response body instead.

Spam protection toggle

Spam protection is on by default. While enabled, Formcrest checks the hidden honeypot field on every submission and silently drops anything that trips it. You can turn this off, but we recommend leaving it on — the honeypot costs you nothing and stops the bulk of automated spam. See Spam protection for how the honeypot works and how to add the hidden field to your form.

Require Turnstile

A separate toggle that, when on, requires every submission to carry a valid Cloudflare Turnstile token. If the token is missing or fails verification, the submission is treated as spam. When you enable this, your form must include the Turnstile widget and the cf-turnstile-response token field, or every submission will be rejected. Turnstile is available on every plan. Full setup instructions are in Spam protection.

Domain whitelist (Pro and Agency)

The domain whitelist restricts which sites may post to your form. When you add one or more entries, Formcrest checks the request's Origin (falling back to Referer) host against the list. A request whose host is not allowed is rejected with domain_not_allowed. An empty whitelist allows any origin.

This setting is available on the Pro and Agency plans. See Plans & top-ups.

Matching rules

A plain entry matches that domain and all of its subdomains. To pin an entry to one exact host, prefix it with =.

• example.com — matches example.com, www.example.com, app.example.com, and any other subdomain.
• =app.example.com — matches only app.example.com. Neither the bare example.com nor www.example.com is allowed.

Wildcard syntax such as *.example.com is not supported — a bare domain entry already covers its subdomains, and = covers the single-host case.

Destination emails

Every form delivers to one or more verified destination emails. Free plans are limited to a single destination; Pro and Agency forms can fan out to several recipients. All destinations must complete a one-time verification before they receive anything. This is covered in detail in Multiple recipients, with plan limits on Plans & top-ups.

Settings by plan