Google Sites Contact Form
Add a contact form that emails you to a Google Sites page
Last updated
To add a contact form that emails you each message to a Google Sites page, without a backend, paste the HTML form below into an Embed code block on your page. The form posts to https://api.staticforms.dev/submit with your form's API key, Static Forms emails each submission to you, and the visitor sees a confirmation without leaving the page. It works on the free plan.
1. Copy the form
Replace YOUR_API_KEY with the key from the General tab of your form in the app. The key is visible in the page, which is expected: the form API key cannot read submissions.
Google Sites asks for JavaScript inside <script> tags and CSS inside <style> tags, as above. The visitor's email field becomes the reply-to address on the notification, and every other named field appears in the email, so add a phone or company field the same way.
2. Embed it in your site
Open the page
Open your site in Google Sites on a computer and go to the page for the form.
Insert an embed
Click Insert, then Embed, then the Embed code tab.
Paste the form
Paste the code, click Next, then Insert.
Publish
Click Publish at the top right to make the change live.
If the form is cut off, make the embed box taller in the editor and publish again. To give the form a page of its own, use Pages > Add > Full page embed instead.
Domain restriction
If you turn on domain restriction (Starter and up), send a test message from the published page. Embedded code may not send the request from your site's own domain, and a domain that is not on the list is rejected with a 403 that names it. Adding that domain lets every page on it submit, so you may prefer to leave domain restriction off for this form.
3. Test it
Open the published page, send a message and check that the confirmation appears. The message arrives by email and is listed in the Inbox in the app.
Spam protection
Every submission goes through the built-in spam filter, and the honeypot field catches bots that fill in every field. CAPTCHA widgets and their field names are in the plain HTML guide. A longer walkthrough with styling is in the Google Sites tutorial.
Troubleshooting
| What you see | Why, and what to do |
|---|---|
| 401 "Invalid API key" | Check that the apiKey value matches the key on the form's General tab, with no extra spaces. |
| The form shows as text, or not at all | Paste the code in the Embed code tab, and include the whole snippet with its script and style tags. |
| A field is missing from the email | Give the input a name attribute. |
| 403 "Submission rejected: Domain … is not in the allowed domains list", or "Unable to determine origin domain" | Domain restriction is on for the form, and the embed did not send the request from an allowed domain. See the domain restriction note above. |
| No email arrives | Check your spam folder, then the Inbox in the app: if the submission is listed, the problem is delivery. |
FAQ
Does this work on the free plan?
Yes. The snippet only uses Free plan features: 250 submissions every 30 days, 1 form endpoint, email delivery, the built-in spam filter, a honeypot field and reCAPTCHA v2. No credit card is needed.
How do I keep spam out?
Every submission is checked by the built-in spam filter on every plan. The snippet adds a hidden honeypot field (any field whose name contains "honeypot"); bots fill it in and those submissions are dropped. reCAPTCHA v2 is available on Free. Cloudflare Turnstile, hCaptcha, ALTCHA and reCAPTCHA v3 are available from the Starter plan.
Is it safe to put the API key in my HTML?
Yes. The form API key is meant to be public. It cannot read your submissions or sign in to your dashboard.
Why not embed a Google Form?
You can. This form uses your own fields and markup on the page, and Static Forms emails each message to you with the visitor's address as reply-to, with spam filtering and an Inbox of past submissions.
