> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allgoodhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What protects a form

> The defenses enforced on every submission, where a form's technical details live, and where to configure them.

allGood enforces these checks itself, not your page. A page can't be trusted to police itself.

| Defense | What it does |
| - | - |
| **Registered forms only** | An unknown form id is refused |
| **Allowed origins** | Submissions only accepted from websites you listed, exactly as the browser sees them |
| **Honeypot** | A hidden field that only a bot fills |
| **Bot check** | A token allGood verifies before accepting |
| **Rate limiting** | Floods from one origin or address are throttled |
| **Payload cap** | Oversized submissions are rejected, not truncated |

Every response says which one answered, so a submission that didn't arrive has a reason you can look up rather than a mystery. A form's **Test** section lists every one of these, resolved to the value that actually applies to it, not the generic setting.

![Every check a form's Test section lists, resolved to this form's actual values](https://mintcdn.com/allgoodtechnologyinc/9DaQ84rhZ2o4ihI1/images/mk/content/forms/form-test-section.png?fit=max\&auto=format\&n=9DaQ84rhZ2o4ihI1\&q=85\&s=efb37879d918c412b30f6643981f5d2d)

Every check a form's Test section lists, resolved to this form's actual values.

> [!NOTE]
>
> The submitter's IP address is read to throttle abuse and is never written to storage. There's no retention window to configure and nothing to erase on request.

## A form's technical details

A form's **Settings** tab shows its capture endpoint, Form ID, content type, serving domain, and whether it's registered. It's not where allowed origins or spam rules live — those are account-wide.

Allowed origins and the bot check are account-wide [Web Edge settings](https://docs.allgoodhq.com/mk/settings/web-edge/connect-a-subdomain.md) — see [bot protection](https://docs.allgoodhq.com/mk/settings/web-edge/bot-protection.md) if submissions aren't behaving as expected. Consent is a named, reusable consent text your account manages, which a form binds to — see [consent provider](https://docs.allgoodhq.com/mk/settings/web-edge/consent-provider.md) setup if consent isn't recording as expected.

## For developers

> [card] [What the website needs](https://docs.allgoodhq.com/mk/developer/web-edge/create-a-form.md)
>
> The two things to hand over: the form's short id, and confirmation it is registered.

> [card] [Allowed origins](https://docs.allgoodhq.com/mk/settings/web-edge/allowed-origins.md)
>
> The technical detail behind the setting above — how origin matching actually works.

## Related articles

* [What a form is](https://docs.allgoodhq.com/mk/content/forms/what-a-form-is.md)
* [Testing a form](https://docs.allgoodhq.com/mk/content/forms/testing-a-form.md)
* [Form not capturing submissions?](https://docs.allgoodhq.com/mk/content/forms/troubleshooting.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.