# Share and embed

Send a form as a link or paste one embed code into any website; the captcha and spam rules come with it.

Every published form has a hosted page and an embed code. Both include the
form's [spam protection](/forms/spam-protection), so there is nothing to
install and no keys to handle on your site.

```html
<iframe
  src="https://console.buildbase.app/form/ORG_ID/FORM_ID?embed=1"
  title="Contact us"
  data-buildbase-form
  loading="lazy"
  style="width:100%;min-height:420px;border:0"
></iframe>
<script>
  window.addEventListener('message', function (e) {
    if (
      e.origin !== 'https://console.buildbase.app' ||
      !e.data ||
      e.data.type !== 'buildbase:form-height' ||
      typeof e.data.height !== 'number'
    )
      return;
    document
      .querySelectorAll('iframe[data-buildbase-form]')
      .forEach(function (f) {
        if (f.contentWindow === e.source) f.style.height = e.data.height + 'px';
      });
  });
</script>
```

> **Note:**
  Copy the exact link and embed code from the form's page in the BuildBase
  console, under **Forms > (your form) > Share and embed**. The form must be
  published to accept submissions.


## The link

The hosted page is `https://console.buildbase.app/form/ORG_ID/FORM_ID`. It
shows the form's title and description in a centred card, with the captcha
above the submit button when the form requires one. After a successful
submission it shows "Thank you" and a **Submit another response** button.

A draft, archived or unknown form answers with a not-found page, so an old link
does not reveal that a form ever existed.

## The embed

Paste the code where the form should appear. The `?embed=1` page drops the
full-screen frame and card so the form sits in your layout.

The script keeps the iframe as tall as the form, including when a validation
message or the captcha changes its height. It only acts on messages from the
console origin and from that specific iframe, so other frames on your page
cannot resize it. The form only ever sends its height, never anything a visitor
typed.

Several forms on one page work with one copy of the script; each iframe needs
the `data-buildbase-form` attribute.

| Attribute          | Why                                                    |
| ------------------ | ------------------------------------------------------ |
| `title`            | Screen readers announce it. Set to the form title      |
| `loading="lazy"`   | The form loads when it scrolls into view               |
| `min-height:420px` | Space reserved before the first height message arrives |

> **Note:**
  Only the hosted form page can be framed. The rest of the console refuses to
  load inside an iframe, so embedding a form never exposes anything else.


## Captcha in the embed

The captcha runs inside the iframe on the console's domain. For **Managed** and
**Built-in**, that needs nothing from you. With your own provider keys, the
widget's allowed hostnames must include the console hostname shown in the
**Spam protection** dialog, not your site's: the widget is rendered by the
console page.

## Next Steps

- [Spam protection](/forms/spam-protection) - choose a provider and set rules.
- [Custom forms](/forms/custom-forms) - build the form UI yourself instead.