Form access controls
Close a form when you need to, limit how many real entries it takes, open and close on a schedule, or require a password before anyone can fill it in.
Where to find it
Open a form's Security page. Pause, capacity, password, and schedule sit together under form controls. Confirmation success copy and redirects stay on the builder Settings tab.
Pause
Turn on Pause form to show a closed page instead of the inputs. You can edit the closed message (500 characters). Submit is rejected on the server.
Capacity limit
Set an optional max entries value. Only real submissions count: imported rows and submissions marked Suspicious are excluded, the same way monthly usage ignores imports. The Security page shows X of N entries. When the count reaches the limit, visitors see the closed page (optional separate full message). Submit is blocked on the server.
The capacity check counts before insert. Two people submitting into the last slot at the same moment may overshoot by a small number of in-flight requests.
Password
Set an optional password. GRTforms stores a bcrypt hash, never the plain text, and never returns the hash to the browser, REST API, or MCP tools. Cloning or importing a form does not copy the password; set a new one on the copy. Visitors see an unlock page. A correct password sets an HttpOnly, Secure, SameSite=Lax cookie signed for that form. Changing the password invalidates old cookies. Unlock attempts are rate-limited per IP and form.
Same-site visits keep the cookie. A cross-site iframe often cannot, because SameSite=Lax cookies are not kept in that embed. In that case the unlock page says to open the form in a new tab. Owner preview from the builder skips the password gate.
Schedule
Optional opens-at and closes-at datetimes. You edit them in your timezone; they are stored in UTC. Before it opens, visitors see a not-open-yet message. After it closes, they see the closed page.
What takes priority
Unpublished forms stay unavailable. Then: paused, then the schedule, then capacity, then password. IP blocks still apply after those gates. Each gate is enforced on the public page, submit, file upload (the same submit path), and public form APIs.