Public & Embedded Forms

A public form can be filled by anyone — a prospect on your website, a visitor with a link, someone who has never logged in to your portal. Use it for contact forms, quote requests, applications and lead capture, and let the answers flow into your portal for review.

Making a Form Public

1. Open the form and go to Settings.
2. Under Who can see & fill this form, choose Public / Embeddable — anyone with the link.
3. Save. The form gets its own public link, and a new Embed tab appears in the builder.

The public link uses a random identifier, never the form's name, so it can't be guessed from your form titles.

Optional settings on the same card:

• Allowed sites — one domain per line (use *.example.com for subdomains). When you list sites, only those sites can embed the form. Leave it empty to allow embedding anywhere. Your portal itself is always allowed.
• Run automations without approval — off by default and recommended off. See Approval and Lead Matching.

Setting Up Bot Protection

Public forms always use bot protection, and a public form accepts nothing until a provider is set up. The builder shows a warning on the form until you do.

1. Go to Settings → Authentication → Public forms.
2. Choose a provider: Cloudflare Turnstile (recommended), hCaptcha or Google reCAPTCHA v3.
3. Paste the provider's site key and secret key.

If you already use Turnstile on your login page, public forms use those keys until you add separate ones, so you may not need to do anything. Secret keys are stored encrypted and are never sent back to the browser.

Three Ways to Share It

Everything is on the form's Embed tab:

Option	Best for
Hosted page	A link you can email, post or put behind a button — the form on its own page on your portal
Iframe embed	Dropping the form into any website or page builder that accepts an iframe
Script embed	A tighter fit on your own site — the form resizes itself to its content and picks up the host page for source tracking

The Embed tab also lets you choose a light, dark or follow-the-system theme, an accent colour and whether to hide the form's title, and shows a preview. Copy the snippet you want and paste it into your site.

What happens after someone submits — a thank-you message or a redirect — is a form setting, not part of the embed code. See After Submit.

Spam Protection

On top of bot protection, every public form has built-in spam defences:

• A hidden trap field that people never see but bots fill in. Bots that fill it get a normal-looking success message, and nothing is saved.
• A minimum fill time. Forms submitted faster than a person could fill them are refused.
• Rate limits per visitor and per form, per hour.
• Allowed sites, if you set them, so other sites can't embed your form.

Adjust the minimum fill time and the rate limits under Settings → Authentication → Public forms → Spam limits. Blocked attempts are logged on the form, so you can see when something is being refused.

Approval and Lead Matching

Public submissions wait for approval before any automation creates or changes a record. You review the answers, see the Approving will… preview, and only then does anything happen. If you trust a form completely, turn on Run automations without approval in its settings.

When a visitor's email matches someone who already has a portal account, the submission suggests that person's client. It is only attached to the client when you approve it — an email typed into a public form is never enough on its own to put data on a client. Everyone else shows as a new lead.

If the form has an Email field, that answer is used as the submitter's email for matching. See Field Types.

Creating a Client from a Submission

Add the Create client from submission automation to a public form to turn a lead into a client from the answers — company name, contact details and so on. Like other automations on a public form, it runs on approval unless you've chosen to run automations without approval.

Where Submissions Come From

Each submission records its source:

• the channel — your portal, the hosted page or an embed,
• the page it was submitted from and the referring site, and
• any UTM tags in the link (campaign, source, medium and so on).

Sources appear on the submission and in the form's reports.

File Uploads on Public Forms

Public forms can accept uploads, with a few rules:

• Private cloud storage is required (Settings → Storage). Without it, upload fields don't show on the public form, so visitors' files never sit in a public folder.
• Files are checked by their actual content, not just their name. Images, PDFs, Word documents and plain-text files are accepted.
• Size limit: set under Settings → Authentication → Public forms → Max upload size, 100 MB by default. A form's own Max file size can only lower it. Visitors' files pass through your web server, so they also can't be larger than your host allows — the setting shows that limit.
• Uploads are held separately and kept only when the form is actually submitted. Files from forms that are abandoned are removed automatically.

What Visitors Never See

A public form shows visitors the fields, steps and logic — nothing else. Your automations, mappings, data sources, prefilled values and the names of other people are never sent to the browser. User picker fields list portal people, so they only appear on portal forms and are left off the public version.