--- title: "Special fields" description: "Field names FormParcel reads, drops or refuses: _next redirects, the _gotcha trap, the bot check proof, the Turnstile token, refused names and columns." url: "https://formparcel.live/docs/reference/fields" --- # Special fields Field names FormParcel reads, drops or refuses: _next redirects, the _gotcha trap, the bot check proof, the Turnstile token, refused names and columns. Every other field in a post is lead content: it is stored with the lead and becomes a column in the Sheet. These names are different. | Field | What FormParcel does with it | | --- | --- | | `_next`, `_redirect` | Read, not stored. Sends a browser to your thank-you page. [Redirects](https://formparcel.live/docs/reference/fields#redirects) | | `_gotcha` | The spam trap. Filled in, the post is dropped. [The spam trap](https://formparcel.live/docs/reference/fields#trap-field) | | `_fp_proof` | The bot check’s proof. Checked, never stored. [The bot check proof](https://formparcel.live/docs/reference/fields#bot-check-field) | | `cf-turnstile-response` | The Turnstile token. Checked, never stored. [The spam check token](https://formparcel.live/docs/reference/fields#turnstile-field) | | Other control fields | Dropped in any letter case. [Dropped fields](https://formparcel.live/docs/reference/fields#dropped-fields) | | Passwords, card details | The post is refused. [Refused names](https://formparcel.live/docs/reference/fields#refused-names) | | `_submission_id` and three more | System columns of the Sheet. [System columns](https://formparcel.live/docs/reference/fields#system-columns) | ## Redirects with _next Put a hidden field named `_next` in a plain HTML form. Its value is the page the visitor should land on. The older name `_redirect` is also accepted, and `_next` wins when both are present. ```html title="contact.html" ``` When the address is trusted, FormParcel answers a browser form post with a `303` redirect to it, after the lead has been saved. FormParcel reads the field and does not store it or write it to the Sheet. A browser that trips the spam trap, for example through autofill, is sent to the same address, so a person never lands on a dead page. ### The trust rule FormParcel will not redirect to an arbitrary address, because that would let anyone use your form to send visitors to another site. A redirect is followed only when the address is on the client’s own site: - It is on the **site’s domain**, the domain you entered for the client site in FormParcel. The scheme, host and port must match. - Or its host is one of the form’s **allowed origins**. A wildcard such as `*.client.example` matches the domain and its subdomains, but not an address with a port, and a wildcard over a shared host such as `*.github.io` or `*.netlify.app` is never trusted. - Or it is a **path** that starts with `/`, such as `/thanks`. It is resolved against the site’s domain, or against the first plain address in the allowed origins, and must stay there. These are never followed: - An address with a username or password in it. - An address that begins with `//`, or that contains a backslash or a control character. - Anything that is not `http` or `https`, such as `javascript:` or `data:`. - A `_next` that is repeated. It must appear once. ### When the address is not trusted The lead is still saved. The visitor sees FormParcel’s short confirmation page instead of your thank-you page. If that happens on your own site, check that the client site’s domain is set in FormParcel and matches the address in `_next`, including `https` and any `www`. | The _next value | Followed? | Why | | --- | --- | --- | | `https://client.example/thanks` | Yes | Same origin as the site’s domain. | | `/thanks` | Yes | A path, resolved against the site’s domain. | | `https://www.client.example/thanks` | Only if allowed | A different host. For redirects, www is not the same as the bare domain: add it to the form’s allowed origins. | | `https://other.example/thanks` | No | Not the site’s domain or an allowed origin. | | `//other.example/thanks` | No | Starts with two slashes. | | `https://client.example@other.example/` | No | Contains credentials. | ### fetch never redirects Anything that is not a browser navigation gets JSON back and no redirect, whatever it sends in `_next` or `_redirect`: fetch, XHR, curl, a server calling FormParcel, a JSON body, or `Accept: application/json`. A script that sends no `Accept` header gets JSON too. With fetch, you decide what happens next in your own code. See [the fetch guide](https://formparcel.live/docs/guides/fetch) and [Responses and error codes](https://formparcel.live/docs/reference/responses). ## The spam trap `_gotcha` is a field people should never see. Bots tend to fill in every field they find. If it arrives with any value, FormParcel drops the post: nothing is saved and no receipt is created. - A script gets an empty `204`. Show no success message. - A browser that trips it, for example through autofill, is shown the same page or sent to the same `_next` address as a real lead, so a person is not left on a page that does nothing. You can change the trap’s name in the form’s settings. A name that matches a common real field, such as `name`, `email`, `phone` or `message`, is refused, because it would drop real leads. When the trap has a different name, a field called `_gotcha` is treated like any other dropped field. How to hide it is on [the plain HTML guide](https://formparcel.live/docs/guides/html#the-trap-field). ## The bot check proof FormParcel’s bot check script adds a hidden `_fp_proof` field to the form. A page that sends with fetch gets the value from `window.FormParcel.proof()` and sends it as a field of the JSON body. FormParcel checks it and never saves it with the lead or writes it to the Sheet. Without a valid proof, or with one sent a second time, the submission waits in the Spam folder. See [Spam protection](https://formparcel.live/docs/setup/spam-protection#the-bot-check). ## The spam check token When a client site has the Cloudflare Turnstile check on, the widget adds a `cf-turnstile-response` field to the form. FormParcel checks it with Cloudflare and never saves it with the lead. A script sends it as a field of the JSON body. See [Spam protection](https://formparcel.live/docs/setup/spam-protection). ## Dropped fields Other form services add control and captcha fields to a post. They are instructions or opaque tokens, not lead content, so FormParcel drops them in any letter case: they are not stored, not in the Sheet and not in email. `_gotcha`, `_captcha`, `_template`, `g-recaptcha-response`, `h-captcha-response`, `cf-turnstile-response`, `_fp_proof` ## Refused names A post is refused with status 422 ([`PROHIBITED_FIELD`](https://formparcel.live/docs/reference/responses#prohibited-field)) when a field is named like a password, a one-time code or a card detail. A post with no readable value in any field is refused too ([`EMPTY_SUBMISSION`](https://formparcel.live/docs/reference/responses#empty-submission)). Neither creates a receipt. The names, and what you must not collect, are on [Limits and retention](https://formparcel.live/docs/reference/limits#prohibited). ## Fields the lead email reads The owner email uses two of your fields. - **Reply-To.** The first field called `email, email_address, your_email, mail, contact_email, _replyto, replyto, reply_to, reply-to` that holds exactly one plain address becomes the reply address, so replying goes to the visitor. - **Subject.** A hidden `_subject` field adds a single-line suffix to the email subject, up to 80 characters. It is an ordinary field too, so it also appears in the Sheet. ## System columns FormParcel writes four columns of its own into every Sheet it creates: `_submission_id`, `_received_at`, `_source_site` and `_source_form`. A form field with one of those names is written to a column called `custom_` followed by the name, so it never overwrites a system column. What each one holds is on [Google Sheets](https://formparcel.live/docs/setup/google-sheets#what-is-in-the-sheet).