Set up consent and double opt-in

Choose what a signup means: collecting details, subscribing to email, or subscribing after the visitor confirms their address. Set this before you publish the form.

How consent works on a form

Configure consent in the form's Builder with editing access. The form's settings and the visitor's choice determine subscriptions and topics; submitted field values cannot override them.

For a newsletter with an optional checkbox, a checked box adds consent. An unchecked box collects the details without adding consent. It does not unsubscribe an existing subscriber.

Consent modes

• On submission: submitting adds email consent. Describe the subscription in the form copy.
• On submission if checked: only a checked consent box adds the subscription. Set its label to describe what the person will receive.
• Off: the form adds no marketing consent. Existing subscriptions remain unchanged.

Selected public communication topics are added only when the visitor opts in. They are configured by you, rather than selected by visitors.

Double opt-in

With Enable Double Opt-In on, an opted-in submission follows three steps:

1. Its details wait for confirmation.
2. maxclicks sends a single-use link valid for 24 hours.
3. Opening that link saves the contact and records confirmed consent.

An expired, unconfirmed submission needs a new form submission to request another link. Confirmation is limited to two emails per address per form per hour, and 200 per form per hour.

With an optional checkbox left unchecked, no confirmation email is sent. A new email-only contact is stored unsubscribed; a matching existing contact keeps its subscriptions and topics.

Double opt-in uses fixed check-email and subscription-confirmed screens. Custom thank-you messages, coupon codes and redirects are ignored. The hosted form still shows its check-email screen when the optional checkbox is unchecked, so test that case too.

The consent audit trail

The contact's audit trail records granted consent and distinguishes single from double opt-in. Inspect it alongside the contact's current subscriptions and topics. The audit trail does not replace a review of the wording you used to ask for consent.

Add a CAPTCHA

Built-in rate limiting applies to every form. To add Cloudflare Turnstile, Google reCAPTCHA v3 or hCaptcha:

1. Get the provider's site key and secret key for your site.
2. Have an Admin with editing access save them in Settings → Forms Protection.
3. Select that provider in the form's Form Protection settings.

The settings page requires administrative access; saving keys also requires editing permission. The secret is encrypted and not shown again. A provider selected without valid keys blocks submissions.

Hosted forms and embeds handle the challenge. A custom form must integrate the provider and send a valid captchaToken; the Share tab hides its basic custom-form snippets while protection is enabled. Keep secret keys out of browser code.

Why consent matters for your sends

A marketing recipient needs email consent and any topic subscription required by the message. Suppressions can still block sending. An existing subscriber who declines a new form checkbox may remain eligible because their earlier consent is preserved.

The confirmation email uses a maxclicks address. Your follow-up broadcast or workflow still needs a verified sending domain and available allowance or credits.

Where consent fits with the rest of the form

After building the form, check both consent choices and any double-opt-in behavior. Then publish and test it. Inspect the saved record and any workflow it starts.