Hugo forms to Google Sheets

Hugo builds sites in milliseconds and ships them as pure static files - which is exactly why it has never had an answer for forms. There is no server in a Hugo deploy, so there is nothing to receive a POST. SheetLink Forms fills that gap without changing your architecture: you point a form's action at a permanent endpoint of the shape https://sheetlinkforms.com/f/{token}, and each submission lands as a row in Google Sheets or an Excel Online table. No serverless functions, no third-party JavaScript widget rendering your form for you, and nothing added to your build.

Delivery is direct: an asynchronous worker writes straight to the Google Sheets API or Microsoft Graph - no Zapier, no webhook-replaying middleman - with retries at 5 minutes, 30 minutes, and 2 hours. Every attempt shows in a delivery log in the dashboard, and a formula-injection guard escapes leading =, +, -, and @ characters so a hostile submission cannot become a live formula in your ledger. There are no per-submission fees, ever.

Because the integration is just HTML, it slots into Hugo's own idioms: the form lives in a partial, the token lives in your site config, and content authors can drop the form into any markdown page with a shortcode. You can see the receiving end working on the live demo. SheetLink Forms is free during beta and invite-gated - join the waitlist to get an endpoint.

The best path is a plain form action wrapped in a Hugo partial. Put the token in hugo.toml under [params], read it in the partial with .Site.Params.sheetlinkToken, and include the partial wherever the form should appear. That keeps the token in one place, keeps the form markup in one file, and means switching endpoints later is a one-line config change followed by a rebuild. The endpoint accepts the standard urlencoded post (bodies capped at 256KB) and answers with a 303 redirect to a hosted thank-you page or a custom redirect URL - no JavaScript required, which suits a generator whose output is static by definition.

If you want AJAX submits and ad attribution, add the optional sl.js embed to your base template (layouts/_default/baseof.html) so it ships on every page. It upgrades the same form to an inline-success AJAX submit, auto-injects the honeypot, adds a timing signal used in spam screening, and captures utm_source, utm_medium, utm_campaign, utm_term, and utm_content plus the gclid, wbraid, gbraid, fbclid, and msclkid click IDs - persisted in localStorage so attribution survives a visitor browsing several pages before submitting.

Sign in and connect Google Sheets with one-click OAuth. The connection uses the drive.file scope, meaning SheetLink Forms can only touch sheets you pick in the Google picker or create inside the product - the rest of your Drive stays out of reach. On Microsoft 365, connect Excel Online instead and pick an Excel table; the table's columns define the row shape. You get a permanent endpoint at https://sheetlinkforms.com/f/{token}.

Add it under [params] as sheetlinkToken = "slf_yourtoken". Site params are the Hugo-native home for values templates need everywhere; the token is safe to render into public HTML because the endpoint is designed to be public and screened by its own spam layers. If you ever rotate tokens or run separate forms for separate sites, the change stays in config, not scattered through templates.

Save the snippet above as layouts/partials/contact-form.html and render it in any template with {{ partial "contact-form.html" . }}. Name inputs after your column headers and mapping happens automatically - matching is case and punctuation insensitive, so Email, email, and E-mail all land in an Email column. Keep the _slhp honeypot input exactly as-is: it is the only signal that marks spam outright, while everything else suspicious is quarantined for one-click review, never silently dropped.

Content authors write markdown, not templates, so give them a shortcode: create layouts/shortcodes/contact-form.html containing {{ partial "contact-form.html" . }}, and any content file can place the form with {{< contact-form >}}. The same partial now serves layouts and content alike, and there is exactly one copy of the form markup to maintain.

Drop the script tag into baseof.html before </body>; it binds any form whose action points at /f/ and upgrades it to an AJAX submit with inline success text, plus UTM and click-ID capture. Then run hugo, deploy, and send a test submission. On an empty sheet the header row is seeded for you; after that, rows append under the header. Watch the attempt in the delivery log, and see the full pipeline on how it works.

Does this add anything to my Hugo build?

Can I put the form inside a markdown content page?

Does it matter where the site is hosted?

How is spam handled with no backend of my own?

What does it cost?