Forms

Add a form block to a page and publish your site. You'll find a number of form blocks in the block library; modify one or build your own by hand or with the AI assistant.

Forms are available on paid plans only. Every form includes Cloudflare Turnstile spam defense, which is usually invisible to visitors.

How a submission is handled depends on your plan:

• Solo: you get an email for each submission. Nothing is stored in Geppetto; the email is your record. There's no dashboard.
• Team: submissions are stored and emailed. You can browse, search, export to CSV, and delete them in the Form Dashboard (the bell icon).

By default, notifications go to the site owner's email. Change this in Settings → Forms → Form notifications.

• Recipients: a comma-separated list (sales@example.com, ops@example.com). Leave it blank to fall back to the site owner's email.
• The toggle: turns notification emails on or off.

On Solo, leave notifications on. Since email is the only delivery, turning the toggle off means submissions are accepted but neither emailed nor stored. They're lost. On Team, turning it off just stops the emails; submissions are still saved to the dashboard.

Once a Team site has its first submission, a bell icon appears in the top-right of Geppetto. It opens the Form Dashboard, where you can review, search, export, and delete submissions. An amber dot on the bell means a new submission has come in. The bell is visible to Publishers and above.

• Monthly submissions. Solo: 500, Team: 5,000, counted over a rolling 30-day window. Over the cap, new submissions are refused until the window rolls off.
• 50 fields per submission.
• 5 submissions per IP, per form, per 10 minutes (a spam throttle).
• No file uploads.
• Retention (Team). Stored submissions are kept for 2 years by default; you can set a shorter window in settings. If you downgrade from Team, stored submissions are deleted after a 30-day grace period. Export first if you need them.

Form submissions contain personal data: names, emails, private details about your visitors.

• You own this data. Geppetto stores it on your behalf (on Team). We don't read it, mine it, or share it.
• Fulfilling a data request. On Team, use search to find a visitor's submissions, the detail view to read them, CSV export to hand them over, and delete to remove them. On Solo, the notification email is the only copy. There's nothing stored to export or delete.
• Deleting a submission is permanent. There's no undo. We write an audit-log entry (who deleted what, when) so you can show you actioned the request, but the data itself is gone.
• Deleting a site removes its submissions too. That happens automatically, after the 30-day soft-delete window. Export the CSV first if you need the data.

Form returns a 404.
The submission came from a domain Geppetto doesn't recognize. Usually that's a site that hasn't been deployed yet. Deploy the site and try again.

Nothing happens on submit: no notification, no thank-you.
Check the deployed page's source for a <div class="cf-turnstile"> element. If it's missing, the Turnstile injection didn't run. Redeploy the site.

Visitor is redirected with ?form_submitted=1 but I never get an email.

• Check Settings → Forms → Form notifications. If the toggle is off, no email is sent.
• Check the Recipients field. If it's blank, notifications go to the site owner's account email. Confirm that's the inbox you're watching.
• Check your spam folder. First-time senders sometimes land there.
• On Team, check the dashboard. A failed email doesn't mean the submission wasn't saved.

No bell icon in the editor.

• The bell is a Team feature and only appears after the first submission. Submit a test form first.
• Contributors don't see it; you need Publisher, Developer, or Owner access.
• If it still doesn't show after a submission, hard-refresh. The check caches for 30 seconds.

Reply button missing in the detail view.
The submission had no field that looks like a clean email address, so there's no one to reply to.

Visitor sees a Cloudflare challenge before submitting.
That's Turnstile's "managed challenge" mode when it can't silently verify the visitor (VPN, strict-privacy browser, unusual signals). Expected, not a bug.

Forms is managed ingress: Geppetto runs the submission worker, stores the data (on Team), sends the notifications, and provides the dashboard. We're responsible for that pipeline working.

We're not responsible for per-visitor spam decisions. Turnstile occasionally blocks legitimate visitors on strict-privacy browsers, VPNs, or low-reputation networks, and there's no way to run Geppetto forms without spam defense.

If Geppetto's spam defense doesn't work for you, point your form elsewhere. Change the form's action to a service like FormKeep, Formspree, or your own backend. Geppetto leaves any form that doesn't post to our worker alone. You give up the dashboard and notification emails but get full control.

We can't debug your individual form HTML. If a form isn't working, start with the troubleshooting list above. Confirming the action URL and redeploying fixes the vast majority of "no submissions" reports.