Submissions
Form submissions are stored in the form_submissions table. Each submission includes the form ID, payload (field values), metadata, and status. You view and manage them in the Forms section of the editor.
Viewing Submissions
- Navigate to the Forms section in the editor
- Select a form to see its submissions
- Click a submission to view full details
Each submission displays the payload (all field values), metadata, and status. You can filter and sort by status or date.
Submission Data
| Field | Description |
|---|---|
| form_id | ID of the form that received the submission |
| payload | Object with field names and submitted values |
| metadata | Additional context about the submission |
| status | Current status (new, read, archived, spam) |
Metadata
The metadata object stores:
| Key | Description |
|---|---|
| ip | Visitor IP address |
| user_agent | Browser user agent string |
| referrer | Referring page URL |
| page_url | URL of the page where the form was submitted |
Ycode records the IP, user agent, and referrer on the server for every submission. The submission details show them as a list, and hide the referrer when it just repeats the page URL. This data helps you analyze traffic sources and troubleshoot submissions.
Statuses
Submissions use four statuses:
| Status | Description |
|---|---|
| new | Unread submission; default for new submissions |
| read | Submission has been viewed |
| archived | Kept for records but no longer active |
| spam | Marked as spam; can be filtered out |
You change status from the submissions list or the submission detail view. Use statuses to track which submissions need attention and which are done.
Spam Protection
Every published form is protected against spam by default — existing sites included, with no setup:
- Same-site only — Submissions must come from your own site. Ycode compares the request origin with the host serving the form, so this works on any custom domain without configuration.
- Hidden decoy field — Each form carries an invisible field that only bots fill in. Those submissions are filed under spam and skip email notifications, webhooks, and app integrations. The bot still gets a success response, so it doesn’t retry.
- Per-visitor rate limit — One IP address can submit up to 10 times per 10 minutes by default.
- Size limits — Oversized payloads, too many fields, and overly long values are rejected.
To loosen these checks — for example to accept submissions from a headless frontend or a shared office IP — use Form spam protection in Settings → Security.
Email Notifications
When email notifications are enabled in the form settings, Ycode sends an email to the configured address on each submission. The email includes the submitted data and uses the subject you set.
Configure this in the form element settings under email_notification: set enabled: true, to (recipient), and subject.
Webhook Triggers
On submit, Ycode can trigger webhooks configured in your project. The webhook receives a payload with the event type, timestamp, and submission data. Use webhooks to send data to external services, CRMs, or automation tools.
See Webhooks for setting up webhook endpoints and events.
App Integrations
Form submissions can trigger app integrations such as MailerLite. When an integration is connected, new submissions may add contacts to a list, send to a CRM, or perform other actions based on the integration configuration.
See Integrations for available integrations and setup.
Tip
Use the spam status to filter out unwanted submissions while keeping them in the database for audit purposes.