A live status page at status.webforms.to shows whether form submissions, the dashboard, the API and the MCP server are up, with 90 days of uptime, daily email deliverability and response times.
Every part is checked every minute from outside our network, and the page runs separately so it stays up during an outage.
Each submission is now tagged by who sent it: a person, an AI agent driving a browser, a verified AI agent, or a bot. Routing rules can act on the tag.
Verified AI agents are checked with Web Bot Auth signatures and shown with their operator's domain.
The inbox shows the tag and why, and a new AI agents tab lists only agent submissions.
Route on _meta.sender and _meta.agent; the tag is also in webhooks, the Submissions API (?sender=) and MCP.
One script tag makes any form usable by AI agents in Chrome: it adds WebMCP descriptions from your form schema and answers agents with JSON instead of a thank-you page.
Add webforms.js after your form; attributes already in your HTML are never overwritten.
Agent submissions get the JSON result and are tagged as browser agent submissions.
The same script runs unfinished-form capture when that setting is on; partial.js keeps working.
Define a form's fields once and WebForms validates submissions and generates agent-ready HTML, TypeScript, Zod, JSON Schema and an OpenAPI document from them.
A Fields and schema editor in each form's settings, with Start from those to suggest fields from past submissions.
Rejecting non-matching submissions is a separate switch, off by default.
Every form has a public schema.json and openapi.json; GET and PUT /v1/forms/:id/schema; MCP tools to read and save it.
When a webhook, Slack, Discord or Telegram delivery gives up, fix the destination and click Replay failed: everything that failed in the last 30 days is sent again.
Replay failed on the Deliveries tab, or Replay on a single row.
Replays keep the original x-webforms-delivery-id and get a fresh signature.
POST /v1/deliveries/replay and GET /v1/deliveries in the API; replay_failed_deliveries over MCP.
Email notifications are never replayed: one failed email is final.
Each email destination can send instantly, as an hourly digest, or as a daily digest at the hour you choose, with optional quiet hours in your own timezone.
Several waiting submissions arrive as one email; a single one arrives as a normal notification.
Test submissions always send instantly, and other destinations are unaffected.
Optionally keep what visitors typed but never sent, once they entered an email address, so you can follow up. Passwords and card numbers are never kept.
One switch in form settings and one script tag; shown in a new Unfinished tab.
Deleted when the visitor submits, or after 30 days; never delivered and never counted.
Agency workspaces can group forms per client and give each client a free, read-only login that sees only their own forms, all on one shared submission pool.
A Clients page with each client's forms, logins and submissions this period.
Client logins do not use a team seat.
Clients over the API (/v1/clients) and clientId on forms.
Each form has a relaxed, balanced or strict spam setting, cold sales pitches are held in their own Pitches lane, and marking something as spam or not spam teaches your workspace's filter.
Block sender in one click, and an email address blocklist per form.
Tell a form which languages to expect, so legitimate non-English messages are not penalised.
Turnstile, hCaptcha and reCAPTCHA now use the site key and secret you enter for each form. A CAPTCHA without a secret stays inactive instead of refusing submissions.
The secret is stored encrypted and never shown again.
Free browser tools for anyone building forms, no account needed: a form debugger, honeypot field generator, disposable email checker, email regex tester, input pattern generator, GDPR consent text generator and a form backend pricing calculator.
Every page on webforms.to has a Markdown version, plus pricing.md and llms-full.txt, so AI assistants and coding agents can read the docs without a browser.
A notification address that bounces is now paused at once instead of being retried, which protects deliverability for every form. Webhooks and chat destinations still retry.
The submission is always stored, so a bounced email never means lost data.