Form Rules
Rules let a form react to what’s in the submission. “When department contains sales, notify the sales channel.” “When website is not empty, it’s a bot, tag it as spam.” “When meeting is checked, send them to the booking page.”
Rules are available on Business plans and up. Plain notifications (every submission goes to a channel) work on every plan.
Where they live
Section titled “Where they live”Open a form and go to the Workflow tab. Notifications you already have show a “When: Always” line under each one. Click add condition to make one conditional. The Rules section below handles the two actions that aren’t notifications: tagging spam and redirecting.
Field names come from your recent submissions, so submit the form once and they’ll appear as suggestions. You can type any field name too.
Conditions
Section titled “Conditions”One condition per rule:
| Condition | Matches when |
|---|---|
| is empty | The field is missing or blank |
| is not empty | The field has anything in it |
| contains keyword | The field contains the keyword, case-insensitive |
| doesn’t contain keyword | It doesn’t |
“Contains” works for dropdowns and free text alike. A department field set to “Pre-sales Team” matches contains sales.
The three actions
Section titled “The three actions”Notify a channel. The existing email, webhook, and Slack destinations, now with a condition in front. A submission that doesn’t match simply doesn’t go to that channel. Everything else about notifications stays the same.
Tag as spam. The submission is stored but moved out of your inbox into the Spam view on the Submissions tab. No notification fires, no auto-responder goes out. The visitor still sees the normal success response, which is deliberate: you don’t want to tell a bot its trick was detected. Spam is deleted automatically after 30 days. False positive? Select it in the Spam view and click Not spam to restore it.
Redirect to URL. Runs at the edge, so it works even for plain HTML forms with no JavaScript. The first matching redirect rule wins, and it takes priority over the form’s default redirect and over a _next field in your HTML, because a rule is the more specific intent. Forms submitted with JavaScript get the URL back in the JSON response as redirect.
A spam recipe
Section titled “A spam recipe”The classic honeypot: add a field to your form that humans won’t see or fill, say website_url with style="display:none". Then one rule: when website_url is not empty, tag as spam. Bots fill every field. People don’t.
Attri’s built-in _gotcha honeypot and Turnstile captcha still run first. Rules are for the junk that gets past them, and for the submissions that are technically human but you still don’t want in your inbox.
Rules are additive
Section titled “Rules are additive”If you’ve used Formspree’s rules, one difference: a rule there replaces the form’s default email. Attri’s rules each fire independently. Your unconditioned notification keeps going to everyone, and a conditional one adds a second destination for the matching subset. Want only the sales channel to get sales submissions? Put the condition on the existing notification instead of adding a new one.