Skip to main content
Every form has a second, stripped-down URL built for living inside someone else’s page: no Dailybread navigation, no sign-in, just the form. Drop it into your own website and customers can send you everything you need without ever leaving your site.

​
Adding a form to your site

  1. Open the form and click Embed.
  2. Copy the URL from the dialog.
  3. Paste it into your website builder, then save and refresh your site.
Most builders have an “Embed” or “Custom HTML” block that asks for exactly this URL. If yours wants markup instead, an iframe pointed at the same URL does the same job:
Give the frame enough height to fit the whole form. The embedded page also reports its height to the page around it, so a site that listens for that message can resize the frame as the form grows.

​
Choosing which sites may embed your forms

By default, a form will happily load in anybody’s page — which is convenient right up until it isn’t. To limit embedding to sites you actually run, go to Settings → Company → General and find the Form embedding section. The list is company-wide: it applies to every form you publish, so you only maintain it in one place.
While the list is empty, your forms can be embedded on any site. The moment you save your first host, every site that is not on the list is blocked. Add all of your sites before you save.

​
What an entry looks like

An entry is a host name, and only a host name: Pasting a full address such as https://www.example.com/ is fine — the extra parts are trimmed off for you when you save. Anything that still has a path or a stray space in it is rejected, with a message saying which entry needs another look. Hosts have to match exactly, and www.example.com and example.com are two different hosts as far as a browser is concerned. If your site answers to both, list both. The same goes for a staging site on its own domain.
Your own preview of a form inside Dailybread keeps working no matter what the list says, so you can check your work without listing Dailybread itself.

​
What the allowlist can and cannot do

The allowlist is enforced by the visitor’s browser, through a standard called Content-Security-Policy. When a listed site frames your form, the browser loads it; when an unlisted site tries, the browser refuses. This stops a real person on a real browser from seeing your form re-hosted somewhere it shouldn’t be. It is not a lock on the form itself. Anything that ignores the policy — an unusual browser, a script, a scraper — is not stopped by it, and the form’s own URL is still public. Treat the list as a way to keep your forms on your sites, not as a substitute for the permissions and validation that guard your data. The other thing worth knowing: a list that is missing your own site is very obvious. The form shows up as a blank space on the page, and your browser’s developer console explains that it was blocked. The fix is always the same one edit in Settings → Company → General.