Squarespace forms to Google Sheets

A plain HTML form in a code block, posting to a permanent endpoint. Rows land in Google Sheets or Excel Online with attribution captured and spam quarantined.

Squarespace's form block is fine until the spreadsheet becomes the working system. Its storage options are built around notifications and basic connections, and the moment you need your own column layout, an Excel Online destination, ad click IDs on every lead, or a spam model you can actually inspect, you are outside what the block will do - and the usual escape hatch is a Zapier plan that meters every submission.

SheetLink Forms takes a different route: a plain HTML form on your Squarespace page, posting to a permanent hosted endpoint. An asynchronous worker writes each submission directly to the Google Sheets API or Microsoft Graph - no middleman - with retries at 5 minutes, 30 minutes, and 2 hours, a delivery log in the dashboard, and a formula-injection guard that escapes leading =, +, -, and @ in cell values.

With the sl.js embed on the page, the form submits inline via AJAX and every row carries utm_source/medium/campaign/term/content plus gclid, wbraid, gbraid, fbclid, and msclkid, persisted across pages - so the lead that arrived three pages before it converted still lands attributed. See how it works or try the live demo.

The best path for Squarespace

The best path for Squarespace is a plain HTML form in a code block, with its action pointing at your /f/ endpoint. To be plain about the requirement: this needs a Squarespace plan tier that allows code - code blocks with scripts and code injection are a premium feature (Business and Commerce plans on legacy billing, Core and up on current plans). On plans without code, there is no clean way in.

Add the form with a code block where you want it, and load sl.js - ideally site-wide via Settings -> Advanced -> Code Injection (footer), so attribution parameters are captured on whatever page a visitor lands on and persist until the form is submitted. The docs cover the endpoint's exact behavior.

<form action="https://sheetlinkforms.com/f/YOUR_TOKEN" method="POST"> <input name="_slhp" tabindex="-1" autocomplete="off" style="position:absolute;left:-9999px"> <label>Name <input name="name" required></label> <label>Email <input name="email" type="email" required></label> <label>Message <textarea name="message"></textarea></label> <button type="submit">Send</button> </form> <script src="https://sheetlinkforms.com/sl.js" data-token="YOUR_TOKEN"></script>

1. Create the form in the SheetLink Forms dashboard

Create a form and connect a destination. Google Sheets uses one-click OAuth with the drive.file scope - the product can only touch sheets you pick in the Google picker or create inside it, never the rest of your Drive. Excel Online writes into a Microsoft 365 Excel table you choose, and that table's columns define the row shape. On an empty Google Sheet the header row is seeded for you.

2. Add a code block with your form

Edit the page and add a Code block where the form should sit.
Paste the HTML form, keeping the hidden _slhp honeypot input - it is the primary bot trap.
Set the action to your endpoint: https://sheetlinkforms.com/f/YOUR_TOKEN.

Name your inputs after your column headers; matching is case- and punctuation-insensitive (Email, email, and E-mail all match), and explicit per-field mapping is available in the dashboard when names cannot line up.

3. Load sl.js via code injection

Go to Settings -> Advanced -> Code Injection and add the sl.js script tag to the footer. Site-wide injection matters for attribution: the script captures UTM parameters and ad click IDs from the URL on any page and persists them in localStorage, so a visitor who lands on a campaign page and converts on your contact page still arrives attributed. It also auto-binds any form whose action points at /f/, upgrades it to AJAX submit with inline success text, injects the honeypot if missing, and adds a timing signal that helps separate humans from bots.

4. Style the form to match your site

A code block form does not inherit the form block's styling, so add a few CSS rules - in the same code block or via Squarespace's custom CSS panel - for spacing, input borders, and the button. Keep the honeypot's inline style untouched; it is what keeps the field invisible to humans while bots fill it in.

5. Save, test, and check the delivery log

Save the page and submit a test. With sl.js present the form submits in place and shows success text; without it, the browser follows a 303 redirect to a hosted thank-you page or your custom redirect URL. Confirm the row in your sheet, then open the delivery log in the dashboard. Anything flagged by the spam heuristics sits in quarantine for one-click review - approve and it delivers.

FAQ

Which Squarespace plan do I need?

One that allows code on pages. Code blocks with scripts and code injection are gated to Business and Commerce plans on legacy billing, and to Core and up on current plans. If your plan cannot add code, it cannot host the form.

Squarespace can already connect forms to storage - why this?

The native form block covers basic collection. SheetLink Forms is for when you need more control: your own column layout with explicit field mapping, an Excel Online destination, automatic gclid/fbclid/UTM attribution on every row, a quarantine-based spam model where nothing is silently dropped, and a delivery log with automatic retries. If the native block already does everything you need, keep it.

Is it free?

Free during the beta, invite required - the waitlist is on the homepage. No per-submission or per-task fees, ever. Planned post-beta pricing (planned, not final): a free tier around 50 submissions a month and a paid plan around $15-19/mo, unmetered.

What stops spam bots from filling my sheet?

Layers: the _slhp honeypot (the only check that marks spam outright), a timing signal from sl.js, per-form and per-IP rate limits, a per-form origin allowlist, and content heuristics for link stuffing, disposable email domains, and empty payloads - with a strictness dial per form and optional Cloudflare Turnstile. Suspicious submissions are quarantined for one-click review, never silently dropped.

Can I redirect to my own thank-you page?

Yes. Plain HTML posts get a 303 redirect to a hosted thank-you page by default, or to a custom redirect URL you set. With sl.js the form submits via AJAX and shows inline success text instead, and you can configure the redirect or success message per form - details in the docs.

Also on: Wix · Carrd · Plain HTML

Request an invite See the live demo