Validations

Server-side validation rules for formbuild.io forms: required fields, email format, max length, and regex patterns.

formbuild.io validates every response on the server before storing it. Invalid responses are rejected with a 400 status and a clear error message — so bad data never reaches your Inbox.

Automatic validation

Some validation happens automatically without any configuration:

Email fields: if your form includes a field named email, _replyto, or replyto, a non-empty value must be a valid email address.
Field limits: we enforce a maximum number of fields and a maximum size per field value to prevent abuse.

In your form settings, open Security & Rules, then use the Server-Side Validation section. Click Add field, choose a configured field name, and select a rule type. Each field can have one custom validation rule. The Required toggle in Form Builder is also enforced by the server without adding a separate rule here.

Available rule types

Type	Value	Behavior
`required`	—	Field must be present and non-empty
`email`	—	Must be a valid email address (if non-empty)
`maxLength`	Number	Maximum character count
`pattern`	Regex string	Must match the regex pattern (if non-empty)

Equivalent rule configuration

The settings below illustrate the rule data stored for four different fields; you configure these through the dashboard controls.

{
  "email":   { "type": "email" },
  "message": { "type": "required" },
  "body":    { "type": "maxLength", "value": 5000 },
  "phone":   { "type": "pattern", "value": "^\\\\+?[0-9\\\\s\\\\-]{7,15}$" }
}

When validation fails

If any rule fails, we respond with 400 Bad Request. JavaScript/API requests receive a JSON body containing an error message that tells you which field failed and why. Standard browser form submissions receive a styled HTML error page.

{
  "error": "Validation failed: email must be a valid email address"
}

The response is not stored. If you're submitting via fetch(), check the response status and show the error to the user. For standard HTML forms, the error page is displayed automatically.

Tips

Use required on fields you absolutely need — e.g. email on a contact form.
Use the Form Builder's Required toggle together with a maxLength rule when a field needs both checks.
Client-side validation (HTML required, pattern) gives users instant feedback, but always rely on server-side rules as the guardrail.