FormFlow Security Features Explained

Published on April 24, 2026

Not every form needs protection, but customer information, employee details, and financial data do. For those, you need control over who can access your forms and when. FormFlow gives you five layers of security, all optional, so you only use what you need.

Quick answer

• Start open by default, then enable only the controls your workflow needs.
• Core controls: passwords, reCAPTCHA/Turnstile, country restrictions, time windows, response limits.
• For high-risk flows, combine multiple layers instead of relying on one control.

Forms Are Open by Default

FormFlow forms have no security enabled by default. When you create a form and share the link, anyone with that link can submit a response. This is intentional. Many forms, like lead capture, event registrations, or public surveys, do not need restrictions.

You add security only when the data requires it.

1. Password Protection

Static Passwords (Insert Forms)

For insert forms, you can set a single password that all users must enter before they see the form. This is useful when you want to limit access to a specific group without generating individual credentials.

Example: A company shares an internal feedback form with employees. The password is shared via the company’s internal chat. External visitors who stumble on the link cannot access the form.

Per-Item Passwords (Update Forms)

For update forms, each item on your board can have its own unique password. These passwords are generated automatically through monday.com automations, so you do not have to create them manually.

Example: A recruitment team sends each candidate a form link to update their application. Each candidate has a unique link and a unique password, so they can only access their own data.

How to Set Up Password Protection

1. Open your form in FormFlow
2. Go to Form Settings
3. Enable Password Protection
4. For insert forms: enter a static password
5. For update forms: set up an automation to generate per-item passwords (see our automation guide)

2. reCAPTCHA / Turnstile (Bot Protection)

Google reCAPTCHA and Cloudflare Turnstile prevent automated bots from submitting your forms. This is especially important for public-facing insert forms that could be targeted by spam.

When to Enable Bot Protection

• Public lead generation forms
• Contact forms linked from your website
• Registration forms shared on social media
• Any form with a publicly accessible link

When You Can Skip It

• Internal team forms with password protection
• Update forms with per-item links (the unique link is already a barrier)
• Forms shared only with known contacts

How to Enable

1. Open your form in FormFlow
2. Go to Form Settings
3. Enable Google reCAPTCHA, Cloudflare Turnstile, or both based on your policy

3. Geographic Restrictions

Geographic restrictions let you limit form access based on the respondent’s country. This is useful for compliance, regional campaigns, or territory-based data collection.

Use Cases

• Compliance — Only accept submissions from countries where your business operates
• Regional campaigns — Restrict a promotional form to a specific market
• Data residency — Accept data only from approved jurisdictions
• Fraud prevention — Block submissions from regions known for fraudulent activity

How to Set Up

1. Open your form in FormFlow
2. Go to Form Settings
3. Enable Geographic Restrictions
4. Select the countries you want to allow (or block)

Users outside the permitted countries will see a message explaining that the form is not available in their region.

4. Time Limits

Time limits let you control exactly when your form is available. You set a start date, an end date, or both. Outside that window, the form is inaccessible.

Use Cases

• Event registrations — Open the form two weeks before the event and close it the day before
• Application deadlines — Accept job applications only until the closing date
• Seasonal campaigns — Run a feedback form only during a product launch period
• Surveys — Collect responses for a fixed period so you can analyze results on schedule

How to Set Up

1. Open your form in FormFlow
2. Go to Form Settings
3. Enable Time Limits
4. Set the Start Date and/or End Date

Before the start date, users see a “not yet available” message. After the end date, they see a “form closed” message.

5. Response Limits

Response limits cap the number of submissions your form will accept. Once the limit is reached, the form closes automatically.

Use Cases

• Limited-capacity events — Accept only 100 registrations
• Contest entries — Cap entries at a specific number
• Beta testing — Collect feedback from the first 50 users
• Resource allocation — Limit requests to match available inventory

How to Set Up

1. Open your form in FormFlow
2. Go to Form Settings
3. Enable Response Limits
4. Set the maximum number of submissions

Once the limit is reached, new visitors see a “form is no longer accepting responses” message.

Combining Security Features

These features are not mutually exclusive. You can stack them to create the level of protection your data needs.

Example: Secure Employee Feedback Form

Example: Public Lead Capture Form

Example: Contractor Status Update

Security Without Friction

The goal is to let the right people in and keep everyone else out, without making the form a chore to fill out. FormFlow lets you add exactly as much security as the data calls for.

Start with an open form and add controls as your workflow demands. If you are collecting truly sensitive data, combine multiple layers for defense in depth.