Question 1

My form submits but I never get an email.

Accepted Answer

Check three things in order: the destination is active (Form → Destinations - a paused or failed destination is skipped), the delivery log for that submission (Form → Submissions → the row → Deliveries shows the exact provider response), and your inbox's spam folder for the first message from a new sender address. If the delivery log shows a success and the email still never arrives, the receiving mailbox rejected or filtered it after accepting it - that part is outside what any sender can see.

Question 2

I'm getting a CORS error in the browser console.

Accepted Answer

The ingest endpoint sends permissive CORS headers by default, so a bare CORS error almost always means the request never reached WebForms at all - check the URL for a typo, or that _next/action points at https://send.webforms.to/wft_... and not a local or staging copy. If you've set an origin allowlist (allowedOrigins) on the form, requests from any other origin are refused before CORS even applies - that shows up as a 403 in the response body, not a browser-level CORS block.

Question 3

Real submissions are landing in quarantine.

Accepted Answer

Open the submission and check which signal fired - the dashboard shows the exact reason (honeypot, time trap, blocked domain, AI classifier, etc.), not just a score. If it's the time trap, your form may render _start_time later than expected (e.g. behind a slow third-party script) - loosen timeTrapMs. If it's the AI classifier flagging legitimate messages in a specific format, disable aiClassifier for that form and rely on the other signals instead. See spam protection for what each signal actually checks.

Question 4

A webhook destination shows repeated failures.

Accepted Answer

The delivery log includes the HTTP status and body your endpoint returned. A 2xx is required for success - anything else retries with backoff, then stops and marks the destination failed after repeated permanent-looking failures (4xx). Also check that you're verifying the signature correctly if verification is failing silently on your side; see webhook signing for the exact header names and a worked example.

Question 5

Can I use one form endpoint on multiple websites?

Accepted Answer

Yes, nothing ties a public key to a domain unless you explicitly set allowedOrigins. Multiple sites sharing one endpoint means their submissions share one delivery configuration and one spam config too, which is usually not what you want for unrelated sites - most people create one form per site instead.

Question 6

What happens when I hit my plan's submission quota?

Accepted Answer

New submissions are refused with a 402 quota_exceeded until the plan resets (monthly) or you upgrade. Nothing already stored is deleted or hidden. There's no overage billing - the endpoint simply stops accepting until the quota window resets or you change plans.

Question 7

How long are submissions kept?

Accepted Answer

Per your plan's retention window, after which they're deleted automatically. Export what you need before then - there's no built-in undo for retention-based deletion.

Question 8

Does WebForms store file uploads forever?

Accepted Answer

Files follow the same retention window as the submission they belong to. See file uploads for size and type limits.

Question 9

I revoked an API key but requests are still succeeding.

Accepted Answer

They shouldn't be - revocation is checked on every request with no cache or propagation delay. If you're still seeing success, confirm you revoked the key you think you did (check the prefix shown in Settings → API keys against the one in your script) rather than a different, still-live key.

Question 10

Can an AI agent do everything a human can in the dashboard?

Accepted Answer

Reading is complete: forms, submissions, usage and stats are available over both the REST API and MCP. Writing covers forms, destinations, routing rules, custom templates, API keys, and team member management - see the write API page for the full scope. Three things are dashboard-only on purpose, not as a gap to be filled later: a person's own account settings (no API key represents a logged-in human), sending a team invitation (the one write action that emails someone), and billing (spending the workspace's money is not something an API key gets to do).

FAQ & troubleshooting

Questions