Public Forms

Forms can be shared via public URLs so respondents can submit without needing an admin account. This requires the PUBLIC_FORMS feature flag, which is enabled by default.

Public URL Format

Each form gets a unique public URL at /filaforms/{ulid}, where {ulid} is the form's globally unique ULID identifier. ULIDs are unique across all tenants.

Route Configuration

Public form routes are registered under a configurable prefix with the web middleware group. All route settings are managed in config/filaforms.php under the routes key.

'routes' => [
    'prefix' => 'filaforms',
    'middleware' => ['web'],
    'domain' => null,
],

Form Availability

A public form is accessible when all of the following conditions are met:

• Form is marked as public (is_public = true)
• Form is active (active = true)
• Current date is within the starts_at and ends_at range, if set
• Submission limit (maxSubmissions) has not been reached
• If onePerPerson is enabled, the visitor has not already submitted

Embedding via Livewire

You can embed forms directly in any Blade view using the Livewire component. Pass a Form model instance to render the form inline.

<livewire:filaforms::form-renderer :form-record="$form" />

Standalone Mode (JSON)

Render a form from a JSON schema without a database record. This is useful for forms defined in code or imported from external sources.

<livewire:filaforms::form-renderer :form-schema="$jsonSchema" />

Post-Submit Behavior

After a successful submission, the form can either:

• Show a success message with configurable text
• Redirect to a URL

This is configured in the form's experience settings using the PostSubmitAction enum.

Access Control

Private forms (is_public = false) require authentication. Public forms are open to anyone. Submission limits apply to both modes:

• One per person -- prevents duplicate submissions from the same visitor
• Max submissions -- caps the total number of submissions the form accepts

Honeypot Protection

Honeypot protection is enabled by default. A hidden field is added to the form to catch bots. If a bot fills in the hidden field, the submission is silently rejected.