01It can be built without a mouse
The drag-and-drop canvas has a full keyboard equivalent: every field can be added, moved and removed from the keyboard alone. A builder that only answers to dragging shuts out the people who cannot drag.
02Close to thirty field types
Text, email, telephone, URL, number, date, time, dropdown, radio, checkbox, rating, slider, colour, file upload, name, address, ordering and page break — the ordinary form is already covered.
03Columns that keep the reading order
A field placed in a column is still read in field order, so a screen reader and a sighted visitor meet the same form in the same sequence.
04Conditions are decided on the server
Nested AND/OR groups with fourteen operators, evaluated again when the form is submitted. A field hidden in the browser cannot be slipped past by editing the page, and the rules still hold with JavaScript switched off.
05Access rules the browser cannot argue with
Open and close by calendar, cap the number of entries, require a login or a role, or set a password. A closed form refuses a direct submission on the server — not by hiding its button.
06Spam is marked, not deleted
A honeypot and a time trap are on by default and get in nobody’s way; reCAPTCHA v2/v3, hCaptcha, Turnstile, Akismet and keyword, IP and email block lists are optional. What is judged spam is flagged and kept, because a false positive should not cost you a customer.
07Uploaded files are not in the web root
They are written outside it, into a directory nobody can guess, and checked by what the file contains rather than what it is called. They are handed out only through a time-limited link tied to one person.
08Notifications you can audit
Several per form, recipients routed by a field value, an auto-reply to the sender, and a delivery record of what was sent, what failed and why — with a resend for the ones that failed.