v1.74: instant email, routing by answer and three new Security settings
v1.74.0 adds an Instant email option, notification emails routed by a Submission's answer, a choice of Turnstile, reCAPTCHA v3 or hCaptcha, refusal of repeat Submissions, and blocked email domains. This post explains each and where it stops.
FormFlow v1.74.0, released on 26 October 2026, has five entries, all of them additions. This post explains each one; v1.74.0 in the Changelog remains the record of the Release. One note on the title: the CAPTCHA choice and the repeat-Submission refusal are in a Form's Security settings, while blocked email domains are set on an email field in the Fields tab.
Get an email as each Submission arrives
On a Form's Delivery tab, the “Email these addresses” setting now offers Instant beside daily, weekly and monthly.
Each Submission that is not spam is emailed within a minute.
Submissions that arrive together share one email, and an address receives at most one email every five minutes. A burst is merged rather than flooding the inbox: nothing is dropped, only held for the next email.
Instant is on every plan, Free included.
It is the same email as the digest, sent on a one-minute sweep. For the digest itself, see v1.27: a daily Submission digest and v1.73.11: send yourself a test digest.
Route notification emails by answer
Under “Notification emails” on the Delivery tab, “Send some submissions elsewhere” takes routes. Press “Add a route” and choose a Question, an Answer and the addresses to “Send to”: when a select or radio question equals that option, the Submission's email goes to the route's addresses instead of the Form's list.
A Form can have up to 20 routes, each with up to 10 addresses.
Routes work with Instant and with daily, weekly and monthly digests alike.
A route applies to Submissions that arrive after you save it.
If its question or option is later removed, the route is ignored and the Form's list still receives the Submission.
Choose reCAPTCHA, hCaptcha or Turnstile
A Form's Security settings now let you pick its “CAPTCHA challenge”: Turnstile, reCAPTCHA v3 with a minimum score, or hCaptcha.
Add your own keys for reCAPTCHA or hCaptcha in Team settings. The Form editor offers either one only once your Team holds its keys. Turnstile still works with FormFlow's keys on pages FormFlow hosts.
For reCAPTCHA v3 you set a minimum score between 0.1, most likely a bot, and 0.9, most likely a person. The default is 0.5.
FormFlow sends Google and hCaptcha no IP address.
If you switch a Form's challenge, copy its component again: a copy made earlier draws no widget for the new one.
Refuse repeat Submissions
Under Security, “Refuse repeat submissions by” names one field: an email, phone, text or number field. A Submission whose answer matches one already stored is refused and shown “This form has already been sent with this answer.” It is kept under Refused submissions and never counted against your usage. Recover it if you do want the second entry.
Spam does not count as a match, so a bot using someone's address cannot lock them out. Blank answers never count either.
The setting is not offered on a Form that admits Submitters by Roster, because each Seat there already has one entry.
It is on every plan.
Block email domains and disposable addresses
An email field can now list domains to block with “Block these email domains”, up to 100, and a domain also blocks its subdomains. “Block disposable addresses” uses a bundled list that FormFlow refreshes each quarter.
A blocked address is refused on that field with “Use a different email address”, on every Form whether or not strict mode is on.
The refused Submission is kept under Refused submissions so you can recover it.
Preflight answers it too, so a Form can check the address before anyone presses Send.
It is on every plan.
What this does not do
A failed CAPTCHA check never refuses a Submission. It marks it as spam, which you can correct from the inbox, and if the provider cannot be reached the Submission goes through. The widget in the visitor's browser still talks to the provider you chose.
Instant does not email spam, and it does not send faster than one email every five minutes to the same address.
A route only matches a single question's answer to a list of addresses. It does not send a Submission anywhere other than email.
Repeat refusal compares one field against what is already stored. It is not a duplicate check across the whole Submission.
The disposable list is only as current as its quarterly refresh; a domain added since will not be on it. Your own list of domains has no such delay.
The full wording of each entry is in the Changelog entry for v1.74.0.