Appearance
Validation
How FlowRunner keeps form data clean and blocks spam: required fields that are checked on the server, the type and pattern rules on the Text input field, and the invisible honeypot that traps bots.
Validation happens in two places. The browser catches obvious mistakes as the visitor types and shows a friendly inline message. The server then re-checks the important rules when the submission arrives — because anything enforced only in the browser can be bypassed by a determined sender or a bot posting directly.
Required fields
Mark any field Required in the inspector and it becomes mandatory.
- In the browser: submitting with a required field empty highlights it in red, shows a message like "Please fill in this field," and focuses the first offending field so it's easy to fix. The submission is not sent.
- On the server: when a submission does arrive, FlowRunner independently looks up every required, named field in the form and rejects the request if any is missing, blank, or whitespace-only. The response lists exactly which fields were missing.
IMPORTANT
Server-side required checks only apply to fields that have a Field name. A field with no name is never captured, so it can't be validated either. Give every field you care about a name — see Forms & fields.
Text input rules
The Text input field has two extra rules beyond "required," both enforced by the browser as the visitor types.
Type
Set the field's Type to validate the shape of the value:
| Type | Accepts |
|---|---|
text | Any text (the default). |
email | A valid email address. |
number | Digits only; the value is captured as a number. |
tel | A telephone number. |
url | A web address. |
password | Text, masked on screen. |
date / time | A calendar date / clock time via native pickers. |
A mismatch shows a message such as "Please enter a valid value."
Pattern
Set a Validation regex (the "pattern") to require an exact format — for example a postcode, an order number, or a phone shape. If the entry doesn't match, the visitor sees "Format doesn't match the required pattern."
text
Pattern for a UK-style postcode: [A-Za-z]{1,2}\d[A-Za-z\d]? ?\d[A-Za-z]{2}TIP
A pattern narrows what's allowed; it doesn't make a field required. Combine Required with a Type or Pattern when a field must be present and well-formed.
The honeypot
Every published form includes an invisible decoy field called a honeypot. It's a text input positioned off-screen and hidden from assistive tech, so a real person never sees or fills it — but automated bots, which fill every field they find, do.
When a submission arrives with the honeypot filled in, the server:
- responds with a normal-looking success (so the bot doesn't learn it was caught and adapt), and
- silently discards the submission — it's never stored and never reaches your inbox.
The honeypot value is stripped before anything is saved, so it never appears in your responses. You don't configure any of this; it's on by default for every form.
NOTE
The honeypot works alongside two other server guards: a rate limit (a single sender can only submit so many times a minute) and a size cap on the submission body. Together they keep floods and oversized payloads out without you lifting a finger.