Rules
Conditional "when...then" logic — route submissions, change the email, or fan out to integrations based on what was submitted.
Rules let a form react differently to different submissions instead of always doing the same thing. Each rule pairs one or more conditions ("when department is billing") with one or more actions ("send to the billing inbox and post it to Slack"). Rules run top to bottom, after spam filtering and before delivery: every matching rule applies its actions, and a rule can optionally stop the run so later rules are skipped.
Where Rules sits in the pipeline
A submission is checked by Security (captcha, domain restriction) and the spam filter first. Only submissions that pass both reach Rules. From there, Rules decides delivery on top of whatever Delivery would otherwise do.
Anatomy of a rule
A rule has a name, one or more conditions (combined with all or any), and one or more actions. Add up to 10 conditions and 5 actions per rule. Toggle a rule off without deleting it, reorder rules with the up/down arrows, and check Stop processing further rules when this rule matches to make a rule terminal for that submission.
Conditions
Every condition has a subject (what to inspect), an operator, and — except for always and the emptiness checks — a value to compare against. Comparisons are case-insensitive.
| Subject | Reads | Plan |
|---|---|---|
| Every submission | Always matches — use it to apply an action to everything (e.g. set a default subject). | Pro |
| Field value | Any submitted field, by name. | Pro |
| Spam flag | true/false — the field-heuristics verdict (password/crypto/card-shaped field names). | Agency |
| Country | Two-letter code from the edge geo header, e.g. AE, US. | Agency |
| Page URL | The page the form was submitted from. | Agency |
| Referrer | Raw Referer header. | Agency |
| Day of week | monday–sunday, evaluated in the form's timezone. | Agency |
| Hour of day | 0–23, evaluated in the form's timezone. | Agency |
| Has attachment | true/false — whether a file was uploaded with the submission. | Agency |
| UTM parameter | Any query parameter named utm_* on the page URL. | Agency |
Operators available depend on the subject: text subjects get contains, doesn't contain, is, is not, starts with, ends with, is one of, is empty, is filled in, and the Agency-only matches regex; numeric subjects (hour of day) add is greater than/is less than.
Regex is ReDoS-checked at save time
matches regex patterns are linted before saving (catastrophic-backtracking shapes like nested quantifiers or a repeated group containing an alternation are rejected) and bounded at evaluation time. Save fails with a specific error rather than silently accepting an unsafe pattern.
Actions
| Action | What it does |
|---|---|
| Send the notification to… | Adds an additional recipient. Must be a verified address — see below. |
| Set the email subject | Overrides the notification subject. Supports {{fieldName}} placeholders. First matching rule wins. |
| Set the reply-to address | Sets Reply-To on the notification — a literal address or a single {{fieldName}} placeholder (e.g. reply straight to the submitter). |
| Redirect the visitor | Sends the submitter to a URL after they submit, instead of Static Forms' default thank-you response. |
| Send to Slack / Discord / Telegram | Posts to the destination connected in Delivery, or to an additional destination registered on the action. |
| Add row to Google Sheets / record to Airtable / page to Notion | Appends to the connected sheet/table/database, optionally overriding the tab, table, or database. |
| Call a webhook | POSTs the submission as JSON to a URL you set on the action (required — this is not the same URL as the Delivery-tab webhook). |
| Skip the default email | Suppresses this submission's default notification without touching integrations or other rules. |
| Mark as spam | Terminal — stores the submission under Spam and halts evaluation; no email, no integrations for this submission. |
| Discard silently | Terminal — nothing is stored at all. Use for known-junk patterns you never want to see. |
Only verified addresses can receive rule emails
Recipients for Send the notification to… must already be verified — the form's own address, a verified CC address, or an address from your workspace verified emails pool. This is a deliberate anti-abuse limit: rules can't be used to blast an arbitrary address you don't control.
When no rule takes over
When no rule takes over delivery controls what happens on a submission that no send-related rule fully owns:
- Send the default notification email (additive) — the default notification always sends; matched rules add recipients, subject, and integrations on top.
- Only send where rules say (suppress) — nothing sends unless a rule explicitly adds a recipient. Use this when Rules is your only routing logic.
mark_spam and discard override either setting for the submissions they match — they always suppress delivery, since they're terminal.
Recipes
Six built-in recipes scaffold a common pattern in one click, which you then adjust to your fields: Route by dropdown value, Spam quarantine, After-hours to Slack, VIP / high-budget alert, Country-based routing, and New lead to webhook.
Test your rules (dry run)
Before saving, expand Test your rules to run your in-progress rules against a sample submission — nothing is sent or stored. Edit the sample JSON, and optionally simulate country, page URL/referrer, submission time, a file attachment, or the spam-heuristics flag to exercise Agency-only conditions. The result shows the final delivery decision plus a per-rule trace (matched/no-match per condition, planned/skipped per action).
Every real submission keeps its own trace
Once rules are live, each submission's evaluation is recorded and shown in its Inbox delivery details — which rules matched, which didn't, and which actions ran. Useful for confirming a rule actually fired the way the dry-run predicted, or for debugging one that didn't match as expected.
Tier gating
| Capability | Minimum tier |
|---|---|
| Rules (basic conditions + actions), up to 10 rules/form | Pro |
| Up to 25 rules/form | Agency |
| Metadata conditions (spam flag, country, page URL, referrer, day/hour, attachment, UTM) | Agency |
matches regex operator | Agency |
| Each integration action (Slack/Discord/Telegram/Sheets/Airtable/Notion/webhook) | Pro same as the integration itself |
Downgrades don't delete rules
If a workspace downgrades below what a saved rule needs (e.g. Agency → Pro with 15 saved rules, or a rule using a country condition), evaluation re-checks the limit at submit time — extra rules are skipped and Agency-only conditions never match, rather than erroring. Nothing is silently re-enabled by upgrading back either; review your rules after any plan change.
Related
- Delivery — the default recipients and integrations Rules builds on top of.
- Spam Filter — content-based filtering that runs before Rules ever sees a submission.
- Integrations — connect Slack, Discord, Telegram, Sheets, Airtable, or Notion before routing to them from a rule.