What does embedding a form mean?

What the frame is doing

An iframe is a window from your page into another page. The form inside keeps its own styles, its own scripts and its own address, and your page cannot read what is typed into it, which is why a form from one service can sit safely inside a site built with another. The price of that separation is that the two pages do not talk. The frame has the size you give it rather than the size of its content, your site's fonts do not reach inside, and scripts on your page do not see the submission. The frame also needs a title attribute that describes it, because a screen reader announces the frame before the form and an untitled frame tells the listener nothing.

Embed, link or popup

An embed suits a short form that belongs to the page around it: an enquiry form under a service description, a booking request on a contact page, a newsletter box at the end of an article. A link suits everywhere a page does not exist, including email, text messages, printed flyers and QR codes, and it is the better choice for long forms because the form gets the whole screen. A popup suits a single offer shown at a chosen moment, and it is the easiest of the three to get wrong, because a layer that covers what somebody was reading gets closed before it is read. Many teams end up using two: the embed on the website and the same form's link everywhere else.

The problems embeds cause

Height is the first. A frame shorter than the form gives it an inner scrollbar, and on a phone a scroll area inside a scrolling page is easy to miss, so the submit button can sit out of reach. Width is the second. A form designed for a full page, with fields side by side, becomes unusable in a narrow column, and accessibility guidance expects content to reflow at a width of 320 CSS pixels without scrolling in two directions. Sign in is the third. Browsers increasingly block cookies inside frames from other sites, so a form that needs the respondent to sign in often behaves badly when embedded and is better sent as a link.

Stopping other sites from framing it

Any page that can be framed can be framed by anybody, not only by you. Copying an embed code onto another site is the mild version. The serious version is clickjacking, where a hostile page frames a real one and disguises it so that people click or type without knowing where. The standard defence is a frame ancestors policy sent by the server, which tells browsers which sites may frame the page at all. Form tools that are designed to be embedded usually offer a softer, form level list of allowed sites instead, which stops casual copying in ordinary browsers but should not be treated as strong security. The two work at different layers and answer different questions: the server policy decides whether a browser will draw the page inside a frame at all, while a form level list decides whether the form agrees to run once it has been drawn there.

Embedding a form from this builder

There is no embed code generator. A published form is a web page, so it goes into your site with an iframe tag written by hand, using the form's link as the source. To keep it from loading elsewhere, set the access type to domain restricted, which is labelled for iframe embedding, and list your site under Allowed Parent Domains; the builder calls this a light safeguard and suggests secret key or login required for private forms. For a narrow column, a classic form in single column layout mode avoids fields side by side, and a conversational form shows one question per screen, which keeps its height steadier. Access settings travel with the published version, so publish after changing them.

Questions people ask