Signup forms

Why the tag never goes stale

Most signup forms put the form’s markup in the snippet you copy. Change a field, a colour or a message, and the copy on your website is out of date until somebody re-pastes it — which is the most common reason an embedded form stops matching what you built.

Ours carries a form id and nothing else. The form lives here, so every page it is embedded on picks up your edits on the next load.

Create one

Open Audience → Forms and pick a ready-made one: a newsletter box, an inline bar, a welcome popup, a popup with an image, a two-step popup, a sticky bar, lead capture, or a waitlist. Each is a working form — take the closest and change anything you like, or start blank.

Then pick the list new subscribers join, or create one right there if you haven’t got one yet, and the Share tab gives you the snippet.

Where you can put it

Script — the default. One tag, rendered where you put it, inside a shadow root so your site’s CSS can’t affect it and it can’t affect your site. Several forms on one page is the normal case.

Popup, slide-in, sticky bar — the same tag; the form’s kind decides the wrapper. Set a delay, a scroll depth or exit intent, and how long to stay quiet after someone dismisses it.

Iframe for platforms that strip <script>; it reports its own height so it sizes itself. Plain HTML is your actual form, markup and styles, for pages with JavaScript off; a captcha needs JavaScript, so a form that asks for one leans on the honeypot and rate limit instead. It is the one snippet that is markup, so re-copy it after you change the form. React and Vue components are on the Share tab, with no package to install.

Two-step — add a Step break on the Fields tab. Everything above it is step one, everything below step two. A small first ask converts better than a big one, so the classic shape is a single button and the email address after it. Both steps ship in the page, so it still works as one long form if JavaScript never arrives.

Every form is also a hosted page at a link you choose, useful in a bio, an email, or printed as a QR code. WordPress, Webflow, Squarespace, Shopify, Wix and Ghost all accept the script tag or the iframe.

Double opt-in

New forms ask people to confirm by email. It is the default because it is the best thing you can do for deliverability, and because a bot-submitted address never reaches your list.

• Someone submits, gets one email, clicks, and is subscribed.
• One email, however many lists the form feeds. A form pointed at three lists doesn’t put three confirmations in someone’s inbox.
• Until they confirm they aren’t marketing-subscribed, so campaigns skip them.
• If the same address is submitted again within a day we don’t send a second email. That stops your form being used to flood somebody’s inbox, and their original link still works.

Prefer to skip it? Behaviour → Confirmation offers Single (subscribe now, send a welcome) and None (subscribe now, send nothing).

Consent, recorded properly

If your form has a consent checkbox, we store the exact wording shown at the time along with the timestamp, IP address and the page it was on — and repeat that wording in the confirmation email.

A form’s wording changes over time, and “what did this person actually agree to?” is the question you need answered when a complaint arrives. You don’t have to set this up; it is what the consent field does.

Two attributes are set on every form signup so you can segment on them straight away: signup_source (the form’s name) and double_opt_in (whether they confirmed by email).

Keeping spam out

A signup form is a public endpoint that can send email, so every submission goes through a hidden honeypot field, a check that it wasn’t submitted faster than a human could, a signed token proving the form was really rendered, rate limits per address and per network, disposable-address blocking, and Cloudflare Turnstile — which needs no puzzle and which most people never see.

Disposable and free-provider blocking are included on every plan, free ones too. Under Protection you can also pin a form to specific domains so it only accepts submissions from your own site.

Styling many forms at once

Forms inherit from a theme — colours, font, corner radius, button shape, spacing — and store only what they override. Change the theme and every form on it restyles, live, with nothing to re-embed. That is the difference between a rebrand being one edit and twelve.

Themes belong to a project. To use the same brand in another project, copy it; the copy is independent from then on.

Dark mode. By default a form follows the visitor’s own preference: any colour you haven’t chosen gets a dark counterpart, so labels stay readable on a dark page and the inputs don’t glare. Colours you did choose are kept in both — your brand accent shouldn’t change because someone’s laptop is in night mode. Set Always light or Always dark under Design to stop it adapting.

Where it appears, and to whom

The Targeting tab decides whether a page view qualifies at all, separately from the trigger, which decides when within one that does.

• Show on these pages — URL rules that contain, are exactly, start with or end with what you type. No rules means everywhere.
• Except these — checked last and always wins, which is how you say “everywhere but checkout”.
• Who sees it — everyone, first-time visitors, or returning ones.
• How often — until they subscribe, once ever, or every visit.

A popup, slide-in or sticky bar also picks its moment: after a delay, past a scroll depth, or on exit intent. A dismissal rests it for the days you set; subscribing retires it.

Automations and reporting

The Forms page counts shown, submissions and contacts, and the gaps between them are where the answers are. Shown is counted when the form actually appears, not when the page loaded, so a popup whose trigger never fires isn’t counted. Submissions against shown is what a popup’s placement and copy are judged on; contacts against submissions is your double-opt-in confirmation rate.

Use the Form submitted trigger to start a flow. On a double-opt-in form it fires when they confirm, not when they submit, so a sequence never starts for someone who never agreed to hear from you. There is also a one-click email me on each submission toggle.

Forms are a full API resource — see the Forms API — and available from the CLI and the MCP server.