Access and security
Settings → Access and security: “Configure storage and safeguards for public respondents.”
Bot protection
Section titled “Bot protection”Stops automated spam submissions using Cloudflare Turnstile. Each public submission must pass a quick check before it’s accepted. Most real respondents never see a challenge, and some may be asked to tick a box.
It’s on by default for every form. Only turn it off for forms that are filled in by trusted systems, or in testing. You can also toggle it from Form setup → Quick settings on the canvas. The publish check confirms “Bot protection is on”.
File uploads
Section titled “File uploads”Form-wide limits that every File Upload question must stay within:
| Setting | What it does |
|---|---|
| Largest file allowed | The biggest single file anyone can upload on this form. |
| Which files people may attach | The file types the form accepts. |
| DMS storage | Where uploaded files are stored. |
A question can be stricter than these limits but never looser.
Authentication (OTP)
Section titled “Authentication (OTP)”“Verify respondents and configure secure save-and-resume behavior.”
| Setting | What it does |
|---|---|
| OTP Verification | “Verify users via OTP before they can view or fill the form.” Respondents get a one-time code by email and/or SMS. |
| Method | Email, phone, or both. With both: “User must verify email first, then phone number.” |
| Email Field to Prefill & Lock | The Email question filled with the verified address and locked. |
| Phone Field to Prefill & Lock | The Phone question filled with the verified number and locked. |
| Partial Submission (Save & Resume) | Respondents can leave and come back to finish later. “Requires authentication to be enabled” so KyraForm knows who is returning. |
For sign-in with Google and limiting who can respond, see Respondent sign-in.