How to share a form

Every way of sharing a form is the same thing underneath: one public link, delivered through a channel. A message carries it as text. A poster carries it as a QR code. Your website carries it inside a frame. An email carries it under a subject line. What changes from channel to channel is who can find the link, and so what the form’s access setting has to do.

So the answer is short. Publish the form and copy its link. Pick the channel where the people you need already are. Pair the channel with one of the four access types. And test the link through that channel, on a phone, before anyone else sees it.

Start with the link

Publishing is what creates something to share. The Publish tab then shows the form’s public URL with two buttons, Copy and Open. That link is the only thing you distribute, and it is stable: publishing changes later writes a new version of the form without changing the address, so a printed code or an email sent last week keeps working.

The wedding RSVP form, built for a fictional couple, is the simplest case. It is a conversational form of eight questions, only two of them required, and the welcome screen carries the practical facts: the date, the venue and “Please reply by 15 August”. A form like that is shared as a link in a message to guests, because the guest list is the audience and the message is where they already are.

Two habits save trouble here. Open the copied link yourself in a private browser window, so you see what a signed out stranger sees. And when colleagues need to review the form before launch, add ?demo=1 to the end of the link. Every question still works, but submitting records nothing and says so, so test submissions never clutter the responses table.

QR codes on print

A QR code is the link printed as a picture, and it suits anything physical: a poster, a door, a counter, a table card. The Publish tab gives you the link; any QR code generator you trust turns it into an image.

The visitor sign in form is built for exactly this. A fictional food manufacturer puts a code at reception, visitors scan it, and the welcome screen promises “Under a minute”. The form is classic, fourteen fields, half of them single tick site rules and declarations, and it ends on a thank-you screen that says “Your host has been told”.

Print the code, then test the printed version rather than the file, on two different phones, from the distance people will actually stand. Print the web address in words beside it, for anyone whose camera will not cooperate.

Then think about where it hangs. The Australian Government’s cyber security site, cyber.gov.au, describes quishing: phishing through QR codes in emails, on digital platforms or on physical items, and notes that a code hides its link so people cannot check it before scanning. Among its recommendations for businesses is using a secure QR code generator so your brand’s codes are harder to exploit. In practice, a code on a public noticeboard is worth checking every so often to make sure nobody has stuck another code over it.

A code in a public place makes the form public, so the access type is Public. For a shared tablet at a front desk, leave the thank-you screen’s Button URL empty, so pressing the button resets the form for the next visitor.

Embed it on your website

When the form belongs on a page of your own site, place it there in an iframe you write, pointing at the form’s public link. The builder does not generate the markup for you, and the markup is short.

Give the iframe a title attribute. The W3C’s technique H64 explains why: the title attribute labels the frame so people using assistive technology can decide which frame to enter, and it is separate from the page’s own title. A title such as “Webinar registration form” is enough.

The webinar registration form is the kind of form that suits an embed: eight conversational questions sitting on the page that describes the session, so nobody leaves the page to register.

To keep the form on your own site, choose the Domain Restricted access type and list your parent domains, one per line. Subdomains of a listed domain are included, and an empty list leaves the form open to everyone. Two things to know before relying on it. The check reads the origin the browser reports, which can be faked outside a browser, so the app itself describes it as a light safeguard rather than real access control. And once domains are listed, the plain link opened on its own, outside those sites, is refused, so do not also email that link to people.

Email and messages

Email is still how most organisations reach a list, and the link goes in the body like any other. Put it near the top, say what the form is for and how long it takes, and give a reply date.

Expect most people not to open it. Mailchimp’s benchmark page, drawn from campaigns sent through its own platform, puts the average open rate across all users at 35.63 per cent and the average click rate at 2.62 per cent, and notes that Apple’s Mail Privacy Protection affects how opens are counted. Read those numbers as a reason to make the one email count, not to send five. The party RSVP form puts its reply date on the welcome screen and a firm cut off on the thank-you screen, so a single invitation does the work.

If the email markets anything, Australian law applies to it. The ACMA’s guidance on the Spam Act says you must have consent before sending marketing messages, either express or inferred, that you must identify yourself as the sender, and that every commercial message needs an unsubscribe option honoured within five working days. It also says you cannot send an electronic message to ask for consent, because that message is itself marketing. A newsletter signup form is therefore shared on your website and in person, never by cold email.

Match the access setting to the channel

A form has exactly one access type, and the channel should decide it.

• Public suits anything posted, printed or sent to a group you do not control. Anyone with the link can open it.
• Secret Key puts a shared password in front of the form, and it asks for the key every visit. Send the key separately from the link where the details are sensitive.
• Login Required suits staff forms shared on an intranet or in team chat. Turn off allowing any signed in user and list addresses or a whole @domain.
• Domain Restricted suits embeds on your own site, with the limits above.

Access settings are saved with the published version, so publish again after changing them, then test the link through the channel once more. For how these four play out on a form that collects health information, see patient intake form requirements.

Channels at a glance

The table at the end of this article sets out nine ways to share a form, when each fits and the setting to pair with it. The last row, sharing with reviewers through a ?demo=1 link, is the one people skip and then regret when test answers turn up in the launch week export.

Common mistakes

• Sharing the wrong address. Copy the link from the Publish tab, not the builder or preview address.
• Printing a QR code nobody tested. Test the printed code, from where people stand.
• Emailing the direct link of a Domain Restricted form. Outside the listed sites it is refused.
• Changing the access type and not publishing. The live version keeps the old rule until you do.
• Leaving ?demo=1 on a public link. Real answers vanish.
• Sending the same link again and again. Each reminder lowers the value of the next; the note on survey fatigue explains the effect.

Build it

The form access control page sets out the four access types and when each earns its place, and the guide to controlling who can fill in your form covers the Publish tab settings. Classic and conversational forms, built from the same 41 component types, share one publishing flow: a public link with Copy and Open, one access type out of Public, Secret Key, Login Required and Domain Restricted, and the four add-ons (e-signing, webhooks, email alerts and a redirect after submit) deciding what happens once someone who followed your link presses submit.