What is a secret link form?

Unlisted is not the same as protected

A secret link works by obscurity: nobody can open what they cannot find. That is genuinely effective against casual discovery, because a long random address is not something anybody guesses. It does nothing once the address is known, and the form has no way to tell an invited respondent from somebody who was forwarded the email. Search engines are only half the picture. Search engine documentation explains that a noindex rule keeps a page out of search results, but only if the crawler is allowed to fetch the page and see the rule, so a form blocked from crawling but linked from a public page can still surface as a bare address. Being unlisted is a property of how the link spreads, not a lock on the form.

How secret links leak

They leak through ordinary behaviour far more often than through attacks. An invitation is forwarded to a colleague, then to a mailing list. A link is pasted into a group chat, a shared calendar invitation or a public project board. It sits in the browser history of a shared computer, or appears in a screenshot posted to show a problem. Web addresses can also travel between sites: browser documentation explains that the Referer header can carry the full path and query of the page somebody came from, and gives the example of a password reset page whose address reaches a social site through an ordinary link in the footer. Assume any link sent to more than a handful of people will eventually be seen by somebody else.

When a secret link is enough

For a large share of forms, being unlisted is exactly right. An event RSVP, a feedback survey after a workshop, a volunteer roster or a suggestion box gains nothing from a password except fewer answers. The test is what happens if a stranger submits. If the worst case is one odd response you can delete, the link is enough. It also suits forms where you want answers from people you have not identified in advance, such as everyone a partner organisation chooses to pass the link to, as long as you accept that the audience is whoever the link reaches. Watch the volume for the first few days. A sudden jump in submissions, or answers from places and organisations you never contacted, is the usual sign that the link has travelled further than intended.

When it is not

Tighten access when a stranger's submission would cost something real: applications that trigger an assessment, forms that collect identity documents or health information, internal requests that start work or spend money, and anything where knowing who answered is part of the point. In those cases add a check at the door. A shared key keeps strangers out cheaply but still cannot tell you who the person was. Requiring a sign in confirms an allowed account opened the form. Neither replaces asking for a reference number you can verify, which is often the most practical check for forms sent to customers. Whatever the check, say on the form who it is for, so a person who received the link by mistake knows not to use it.

Access types in the form builder

A public form here already behaves as an unlisted one: its address is built on a long random identifier by default, and the public form pages tell search engines not to index them. Secret key is a password gate rather than a secret address; the key is typed in when the form opens, is not part of the URL, and is stored as a hash. Login required allows any signed in account, or a list of addresses and whole domains written as @company.com. Domain restricted limits which websites may embed the form. A form has one access type, and access settings travel with the published version, so a change applies once the form is published.

Questions people ask