Special fields

Any form field whose name starts with an underscore is treated as a control field by Formward. These fields are not shown as submission data in your dashboard. They are stripped before the payload is stored and emailed. All of them are optional.

_redirect

After a successful classic (non-AJAX) form submission, Formward redirects the browser to this URL. To prevent open-redirect attacks, the value is validated before use:

• A relative path (starting with a single /, e.g. /thank-you) is always accepted. Protocol-relative values like //example.com are rejected.
• An absolute URL is accepted only if its origin exactly matches one of the allowed originsconfigured on your form. Any other absolute URL is rejected and the redirect falls back to the form's configured redirect URL, then to the default /thanks.

<input type="hidden" name="_redirect" value="/thank-you" />

_subject

Sets the subject line of the notification email sent to the form owner. If omitted, the subject defaults to New submission to <form name>.

<input type="hidden" name="_subject" value="New contact form message" />

_replyto / _reply_to

Sets the Reply-To header on the notification email. Both spellings are accepted. Useful so you can hit Reply in your email client to respond directly to the person who submitted the form.

<!-- Typically set to the submitter's own email field -->
<input type="hidden" name="_replyto" value="" />
<!-- Or reference a real field with JS, or just hardcode: -->
<input type="email" name="email" id="email" />
<input type="hidden" name="_replyto" id="_replyto" />

The most common pattern is to copy the visitor's email into _replyto via a small script so the field value stays in sync with what they typed.

_gotcha

A honeypot field. It must be present in the form HTML but invisible to real users: hide it with CSS (not display:none, which some bots detect). When Formward receives a submission where _gotcha contains any non-whitespace text, it silently marks the submission as spam and returns a success response to the client. The submission is stored with status: spam and is never forwarded to your notification email.

<input
  type="text"
  name="_gotcha"
  style="position:absolute;left:-9999px;opacity:0"
  tabindex="-1"
  autocomplete="off"
/>

Using position:absolute with an off-screen position is more reliable than visibility:hidden across assistive technologies.

Summary table