Webflow Forms: Validation, Spam Protection, and Integrations

TL;DR: Webflow forms give you required-field validation, HTML5 input types, four documented spam defences and five submission destinations, all configured in the Designer with no code. What they no longer give you is conditional logic, because Webflow sunset Logic on June 27, 2025 and forms that were wired to it became standard forms. Six settings decide whether a Webflow form actually delivers leads, and not one of them is markup.

• Site plan: the free Starter Site plan stops collecting after 50 total form submissions and never resets that counter, while every paid Site plan is uncapped.
• reCAPTCHA toggle: enabling reCAPTCHA validation breaks every form on the site that lacks a reCAPTCHA element, immediately, without a republish.
• Turnstile panel: bot blocking and spam filtering are two separate toggles under Site settings, Apps and Integrations, Cloudflare Turnstile spam protection.
• Submission destination: setting a Custom action removes Webflow storage and Webflow email notifications from the form entirely.
• Notification address: Webflow recommends name-based recipients over role-based ones such as admin@ and info@, which hit deliverability problems.
• File upload: the File upload element requires the Premium Site plan and caps each file at 10MB.

What can a Webflow form do without any code?

A Webflow form ships with a form wrapper, a success message and an error message, and you add fields to it from the Add panel. The available elements are field label, input, file upload, text area, checkbox, radio button, select, reCAPTCHA and the form button, and Webflow requires every one of them to sit inside the form wrapper. On the agency projects I lead, the first build step is naming the form, because Webflow names every new form "Email Form" by default and unnamed forms pool their submissions under one heading in Site settings. If a site will ever carry more than one form, name each one before launch.

Element	What it collects	Plan requirement
Input	A single line such as a name or email	Any Site plan
Text area	Longer multi-line answers	Any Site plan
Checkbox and radio button	Multiple choice and single choice	Any Site plan
Select	A dropdown, optionally multi-select	Any Site plan
File upload	One file per button, 10MB ceiling	Premium, legacy Business, Ecommerce Plus or Ecommerce Advanced
reCAPTCHA	Google Challenge v2 checkbox	Any Site plan, keys required

How does validation work in Webflow forms?

Webflow form validation is browser-native, not rule-based. Each input exposes a Required toggle and a Text type setting that accepts values such as email, phone and password, and the browser enforces those before the form posts. There is no conditional branching, no cross-field rule and no "show this field only if that answer was X" in the product today, because Webflow disabled Logic on all sites on June 27, 2025 and forms attached to Logic flows reverted to standard forms. What I see agencies get wrong here is promising a client conditional questions on a discovery form and then discovering there is no native way to build it. If a form genuinely needs branching, scope custom JavaScript or a third-party form embed at quote time, not at QA time.

Knowing what a visitor sees when validation fails matters as much as knowing what it catches. A Required toggle emits the HTML5 required attribute, so an empty required field is stopped by the browser itself, with the browser's own tooltip wording, before any submission is attempted. That wording is set by the browser and cannot be edited in the Designer, and it is a different thing from Webflow's Error message block, which only appears once a submission has actually been attempted and failed. When a client asks for custom validation copy, that request needs a small piece of JavaScript using setCustomValidity, so quote it rather than assuming a Designer setting exists.

The accessibility rule matters more than most teams expect. Webflow itself warns that placeholder text is not read by screen readers and disappears when visitors start typing, so a placeholder is never a substitute for a field label. Keep the label element and hide it visually if the design demands it.

What can you customise about form messages?

Webflow form messages have three states you can edit in the Settings panel: Normal, Success and Error. The success and error blocks are ordinary elements, so they take any styling, and Webflow's own recommendation is to put a contact email inside the error message so a visitor whose submission fails still has a route to you. The rule I apply on client projects is that the error message always names a real inbox, because a generic "Oops! Something went wrong" costs a lead every time it fires. If your error state has no fallback contact, add one before launch.

What are the Webflow form submission and file upload limits?

Webflow form submission limits depend entirely on the Site plan, and only one plan is capped. Sites on the free Starter Site plan are limited to 50 total form submissions, a limit that does not reset, and once it is reached new submissions are no longer collected at all. Form submissions are unlimited on every other Site plan. File upload is the separate constraint: it requires the Premium Site plan or legacy Business, Ecommerce Plus or Ecommerce Advanced, each button accepts a single file up to 10MB, and a form can carry up to 20 upload buttons. When I audit a Webflow site before handoff, this table is the first thing I check against the client's actual plan.

Constraint	Limit	What happens at the limit
Submissions, free Starter Site plan	50 total, never resets	New submissions stop being collected
Submissions, all paid Site plans	Unlimited	No cap, no per-submission charge
Notification recipients, free Starter	5, all must be Workspace members	Upgrade required to notify anyone outside the Workspace
Single file size	10MB per upload button	Error state fires with a size message
Upload buttons per form	20	Each can restrict its own file types
Form file storage, free tier	10GB	$0.50 per GB per month beyond it
Form file storage, hard cap	100GB	Form submissions stop; the cap cannot be raised
Blocked upload file types	13 extensions	.apk, .app, .bat, .cgi, .com, .exe, .ps1, .gadget, .jar, .sh, .wsf, .tar, .tar.gz rejected

Form file storage is a separate meter from bandwidth, and confusing the two is where quotes go wrong. Webflow charges nothing for the first 10GB of form file storage and $0.50 per GB per month above it, and the 100GB ceiling is a stop rather than a bill: at that point submissions are no longer collected and Webflow states the limit cannot be increased. Bandwidth is metered, priced and upgraded on entirely different terms, which I cover in Webflow bandwidth limits. When I scope a client site that collects files at volume, a quarterly storage check goes into the maintenance retainer, because nothing warns you before the wall.

One more storage detail catches teams out. Deleting form submissions also deletes the attached files and makes their URLs inaccessible, and that is how you clear storage. Export the CSV and download the files before any cleanup.

How do you stop spam in Webflow forms?

Webflow documents exactly four spam-prevention methods: CAPTCHA systems, bot blocking, spam filtering and the honeypot technique, and they stack rather than compete. Bot blocking and spam filtering are two independent toggles that happen to live in the same panel, Site settings, Apps and Integrations, Cloudflare Turnstile spam protection, so switching one on does nothing to the other. Webflow describes bot blocking as using AI to analyse mouse movements, inputs and other signals to separate bots from real visitors, while spam filtering routes anything it flags into a dedicated spam inbox you review separately. In the builds I run, both Turnstile toggles go on first because they cost the visitor nothing, and reCAPTCHA is added only when a specific form is still getting hit. If a client's form is drowning in spam, open that panel and confirm both switches individually before you touch the markup.

What breaks when you enable reCAPTCHA?

Enabling reCAPTCHA validation in Webflow is a site-wide switch, and this is the single most damaging misconfiguration in Webflow forms. Webflow states that enabling it enforces validation for all forms on your site, that any form without a reCAPTCHA element will fail to submit, and that the change takes effect immediately after you save, whether you republish or not. Webflow's integration expects Challenge (v2) with the "I'm not a robot" checkbox and both the v2 Site key and v2 Secret key. Google can also take up to 30 minutes to register your domains, and it automatically registers first-level subdomains of any custom domain you add. Add the reCAPTCHA element to every form on the site before you flip the toggle, never after.

Is the honeypot technique still worth building?

The honeypot technique is a hidden field that bots fill and humans do not, and Webflow publishes its own recipe for it. The instructions are specific in ways that are easy to get wrong: the wrapper class name must not contain words like "hidden", the hidden input needs a tabindex of -1 so keyboard users cannot tab into it, and its label needs aria-hidden set to true so screen readers skip it. A short script then disables the submit button when the trap field is filled. On projects where the client refuses a visible CAPTCHA on a high-intent form, this is the trade I make, and the two custom attributes are not optional if you care about accessibility. Build the honeypot only when you can also own the small piece of custom code in Webflow that goes with it.

Worth knowing for comparison: the engine behind Webflow's native setting, Cloudflare Turnstile, offers three widget modes of its own, Managed, Non-Interactive and Invisible. Webflow exposes it as a simple on or off toggle rather than surfacing those modes, so treat the native switch as a sensible default rather than a tunable control.

Where can Webflow send form submissions?

A Webflow form can send each submission to five destinations Webflow documents, chosen per form in the Settings panel: Webflow storage, email notifications, a webhook, connected Apps, and a custom action. New forms default to Webflow storage plus email notifications, and you can combine most of these freely. The exception is the one that quietly deletes lead flow: the Custom action option cannot be combined with Webflow storage or email notifications, so choosing it means Webflow stops storing and stops notifying. When I inherit a client site with missing leads, a custom action left on the contact form is one of the first things I look for. If you need data in both Webflow and an external service, use a connected App or a webhook, never a custom action.

• Webflow storage keeps submissions in Site settings, Forms, with CSV export of everything including file URLs.
• Email notifications accept the variables {{siteName}}, {{formName}}, {{formData}} and {{formDashboardUrl}} in the subject and body.
• Webhooks issue a Secret key that Webflow shows only once and that you need to validate request signatures.
• Connected Apps cover services such as HubSpot, Zapier and Make while Webflow still processes the submission.
• Custom action posts straight to an external endpoint by GET or POST and bypasses Webflow entirely.

Choosing between the automation platforms themselves is a separate question, and the trade-offs sit in my write-up of the Webflow tech stack rather than here.

Why do notification emails go missing?

Missing Webflow form notification emails almost always trace to the recipient address rather than the form. Webflow sends notifications from a branded address, no-reply-forms@webflow.com, and explicitly recommends name-based recipient addresses over role-based ones such as admin@, info@ and support@ because shared addresses cause deliverability problems. The Reply to field also accepts ASCII characters only. On the free Starter Site plan, notifications are limited to five recipients and every one must be a Workspace member. The rule I give clients is that form notifications go to a named human inbox with a shared alias only as a secondary recipient, never as the only one.

Why is my Webflow form not working?

Most Webflow form failures are configuration decisions made months earlier, not bugs, and each one has a specific and recoverable cause. The six below are the ones I find repeatedly when auditing sites built by someone else, and every one of them is silent: the form looks fine, and the leads simply do not arrive. Work through them in order before you rebuild anything.

Two of those six only surface after a site changes hands, which is why form configuration belongs in the written handover rather than in someone's memory. My Webflow handoff package covers what that document should contain, and the pre-launch checks live in the Webflow QA checklist.

What should you test before a Webflow form goes live?

Testing a Webflow form means submitting it on the published site, not previewing it in the Designer, because reCAPTCHA, Turnstile bot blocking and webhooks all run only on published pages. Webflow also notes that you do not need an active Site plan to receive submissions on the webflow.io staging subdomain, but you do need one to receive submissions on a custom domain, so a staging test proving the form works does not prove production works. On every project I ship, the last pre-launch task is a real submission from a phone on the live domain. If you have not received that test email yourself, the form is not signed off.

• Submit once on the live custom domain, not staging, and confirm the email arrives.
• Confirm the submission appears in Site settings, Forms, under the form's own name.
• Leave a required field empty to confirm the browser blocks it, then force a real submission failure, offline or with a blocked endpoint, to see Webflow's Error block.
• If reCAPTCHA is on, load every page with a form and confirm the widget renders.
• If file upload is used, submit a file at the upper end of the 10MB limit.
• Check the spam inbox after 48 hours to confirm filtering is separating traffic.

Want a second pair of eyes on your client's forms?

If a Webflow form on a site you own or manage is quietly losing leads, I will go through it with you on a 15 minute call and tell you which of the six failure modes above is firing, whether the plan is capping submissions, and what the fix costs in developer time. You get a straight answer on the call, whether or not you hire me afterwards. Book a 15 minute slot here.