InletbaseInletbase

Security

Once your form is live, you want to keep it safe from spam and misuse. Inletbase lets you lock the form so only your own websites can use it, and it adds several protections that work automatically. You will find these settings on the Deploy & Security tab of your form.

Allowed Domains

Allowed Domains lets you say which websites are allowed to send this form. Add your website (for example, yourwebsite.com) and press Enter. You can add more than one.

  • If the list has one or more domains, only those websites can submit the form. Anyone trying to use it from another site is blocked.
  • If the list is empty, the form accepts submissions from anywhere. That is fine while you are testing, but we do not recommend leaving it open once your form is live.

Click Save Changes at the top right to apply it. If your own site is being blocked after you add a domain, check that the domain is spelled correctly. See the Troubleshooting & FAQ for the "domain is not whitelisted" message.

Note: Allowed Domains checks the website a submission comes from, which is a browser based check. If you send submissions from your own server or a script instead of a browser, your API key is what keeps things secure.

Protection that is always on

Every form comes with these protections built in. There is nothing to set up, they work automatically on all plans.

  • Secure API key: every submission needs your form's API key, so random requests without it are turned away.
  • Spam filtering: forms include a hidden anti-spam field (a honeypot). If a bot fills it in, the submission is quietly dropped and no email is sent. Real visitors never see it.
  • Rate limiting: to stop floods of spam, submissions are limited to 30 per minute from one visitor and 120 per minute per API key.
  • Size limit: a single submission cannot be larger than 5 MB.
  • Encryption: data is protected in transit and at rest. See our security overview for the full picture.

Related guides