Send internal email when form submission rejected

A ready-made Shopify Flow workflow. When Workflow Forms refuses a submission, your team gets an email with the form, the reason and the details, so you notice a spam wave, a broken field or a used-up plan at once. Nothing is stored for a refused submission, and the email never contains the submitted values.

Trigger	Form submission rejected (Workflow Forms)
Steps	Send internal email (Shopify Flow)
Needs	Workflow Forms installed and at least one form; an email address for the alert
Built and tested	2026-10-22 in our demo store

The trigger starts at most once per form and reason every five minutes, so a bot hammering one form sends you one email, not a hundred. See Spam protection.

Add it to your store

From Shopify Flow's template library. Open Flow, select Browse templates, search for Workflow Forms and pick this template. Templates appear there once Shopify has reviewed them; if you cannot find it yet, use the file below.

From the file. Download the .flow file attached at the bottom of this page. In Shopify Flow select Import, choose the file, and the workflow opens in the editor.

After adding it

1. Open the Send internal email step and enter the address that should receive the alerts in To.
2. Optionally change the subject and the message. The variables are formHandle, reason (validation, spam, rate_limit or quota), details and locale.
3. Select Turn on workflow.

What the email says

Subject: Form submission refused: {{ reason }}

Workflow Forms refused a submission of the form "{{formHandle}}" on your store.

Reason: {{reason}}
Details: {{details}}
Language: {{locale}}

What the reasons mean: validation = a value did not pass the form's checks, spam = the trap field or the minimum fill time caught it, rate_limit = too many attempts from one visitor, quota = the plan's submissions for the last 30 days are used up.

This alert is sent at most once per form and reason every 5 minutes. Nothing was stored, and the details never contain the submitted values.

Variations

• Only when the plan is used up: add a condition after the trigger, reason equals quota, and point the email at whoever manages the plan.
• Count attacks: replace the email with a step that writes to a spreadsheet or a monitoring tool, for example through Workflow Webhooks or an HTTP request.
• The successful submissions: see Send internal email when form submitted.