Forms on Your Websites

How It Works

A form you add to a page in Websites (the Form block, choosing one of your forms) works on your live website with nothing else to set up. The page shows the form in your website's own colors, and the visitor sends it to your website's own address. Each submission comes into Forms in your account, exactly as it does from the embed script: the same fields, the same thank-you message, and the same choices of where it goes (a CRM lead, a Helpdesk ticket, and Campaigns).

Your form is found by your website's address: the address belongs to your account because you confirmed its domain as yours (Your Website Addresses). Nothing in the page names your account, and no other account's website can send to your forms.

In the Websites editor and preview, the block shows a placeholder with the form's name; the form itself appears on the published website.

Spam Protection

Every check that protects your other forms applies here too:

• the form's Spam protection uses your own Cloudflare Turnstile keys from Forms Settings. A visitor Turnstile cannot confirm is refused with "We could not confirm you are not a bot. Please refresh the page and try again." and nothing is kept. Until your keys are set, a form with spam protection on takes no submissions and says so.
• a hidden field and a minimum time to fill the form in: a bot is told it worked and nothing is kept.
• five tries an hour for each visitor, and 300 an hour for each form.
• the form's Websites list: when it lists any, the form shows and takes submissions only on those websites.
• a form is sent only from a page of the same website. A post from any other website is refused with "This form only takes submissions from its own website."

What Is Kept for Each Submission

The same as every submission (Submissions): the answers, the page it was sent from, the referrer, the first page the visitor saw on this visit, and the five campaign (UTM) values from the address. The visitor's browser keeps the first page they saw and a partner code they arrived with for that visit only, so a form sent later in the visit says where they came from. Nothing else is stored in their browser, and nothing is tracked.

Partner Codes

When Partners is added and a visitor arrives with a partner's link code (?ref=CODE), the visit is counted as a click for that partner, and a form they send during the visit credits the lead to that partner (Links, Signups, and Referrals).

Chat on Your Website

Turn on Chat on This Website in the website's Site Settings, and every page shows your chat bubble from Chat after you next publish. The bubble talks to your website's own address, which finds your account the same way as a form, so no snippet is needed. A visitor's messages come into Chat in your workspace, your team's replies go back to the visitor, and everything in Chat Settings applies: Chat turned on, your list of websites, office hours, and the limits (The Website Snippet). A chat request from any other website is refused.

For AI Agents

Nothing here is an action for AI agents. Visitors send forms from your website; people build forms in Forms and place them in Websites.