Special fields

Any form field whose name starts with an underscore is treated as a control field by Formward. These fields are not shown as submission data in your dashboard or in the notification email. Some, such as _subject and _replyto, are kept with the stored submission because delivery reads them. All of them are optional.

_redirect

After a successful classic (non-AJAX) form submission, Formward redirects the browser to this URL. To prevent open-redirect attacks, the value is validated before use:

• A relative path (starting with a single /, e.g. /thank-you) is always accepted. Protocol-relative values like //example.com are rejected.
• An absolute URL is accepted only if its origin exactly matches one of the allowed originsconfigured on your form. Any other absolute URL is rejected and the redirect falls back to the form's configured redirect URL, then to the default /thanks.

Copy<input type="hidden" name="_redirect" value="/thank-you" />

_subject

Sets the subject line of the notification email sent to the form owner. If omitted, the subject defaults to New submission to <form name>.

Copy<input type="hidden" name="_subject" value="New contact form message" />

_replyto / _reply_to

Overrides the Reply-To header on the notification email. Without it, Formward uses a field named email, so most forms need no extra field and you can hit Reply in your email client to respond directly to the person who submitted the form. Both spellings are accepted, and an invalid address is ignored (the email then has no Reply-To).

Copy<!-- A field named email sets Reply-To by itself -->
<input type="email" name="email" />

<!-- To override it, for example when the form has several email fields,
     name the one that should receive replies _replyto -->
<input type="email" name="_replyto" />

If your email field is called something else, either rename it to email or add _replyto.

_gotcha

A honeypot field. It must be present in the form HTML but invisible to real users: hide it with CSS (not display:none, which some bots detect). When Formward receives a submission where _gotcha contains any non-whitespace text, it silently marks the submission as spam and returns a success response to the client. The submission is stored with status: spam and is never forwarded to your notification email.

Copy<input
  type="text"
  name="_gotcha"
  style="position:absolute;left:-9999px;opacity:0"
  tabindex="-1"
  autocomplete="off"
/>

Using position:absolute with an off-screen position is more reliable than visibility:hidden across assistive technologies.

Summary table