HomeAdd a widgetany website
Add a contact form to any website
Build the form in Sorraia, paste one line into Any website, and every submission lands in your dashboard — styled to match the site, with no plugin and no form-handling code to maintain.
Free plan, no card. Paid plans start at $19 a month.
Why do it this way on any website
A static site cannot receive a form submission — there is no server to POST to, which is the reason so many otherwise-simple sites end up with a backend they did not want. This is the whole problem solved by one script tag: the form renders in your markup, the submission goes to Sorraia, and your site stays static. Works the same in a hand-written page, a Hugo or Eleventy template, or a React component.
See it working
This is a real Sorraia form — our own contact form, embedded here the same way you would embed yours. Send it something if you like; it reaches us.
How to add a contact form to any website
The snippet Sorraia gives you is three lines: a comment, an empty placeholder <div>, and a <script> tag. The div is the anchor — the widget renders exactly where you put it and nowhere else.
In Sorraia, add the website and verify it — a DNS TXT record, or a meta tag in your homepage’s <head>. Verification is what lets you attach a widget to that site, so it comes before there is anything to paste.
Save the form and the Copy Embed Code popup appears; you can also open the Install wizard from the form’s row on the Forms page, which walks you through pasting it and re-checks the page for you.
Copy the snippet from Sorraia. It already has your widget’s id and the right URL baked in, so copy it rather than retyping it.
Open the .html file (or the template, component, or partial) for that page and paste all three lines at the spot in the body where the widget should appear.
Save and deploy.
Load the live page. If nothing renders, open DevTools — the form, calendar and shop loaders log with a [WG] prefix — and check your Content-Security-Policy first.
What you get
Build the form in Sorraia, paste one line into any website, and every submission lands in your dashboard — styled to match the site, with no plugin and no form-handling code to maintain.
Submissions live in your dashboard
Every submission is stored and searchable, filtered by site and date, with no cap on how many you can take — submissions are uncapped on every plan including Free. CSV export is a paid feature, and the export honours whatever filters the list is showing, so what you download is what you were looking at.
It points out which fields hold health data
While you build the form, Sorraia reads your field LABELS and flags the unambiguous ones — date of birth, MRN, insurance or member ID, diagnosis, medication, vitals — and offers to mark them as PHI. It is deliberately conservative and stays quiet on plain name, email and phone fields, because a tool that flags everything gets tuned out. Two things it is not: it reads labels in the builder, never submitted answers, and a marked field only routes into separate encrypted storage once HIPAA is switched on for that site under a signed BAA. Marking is a storage decision, not a compliance certificate — and we are not the ones who get to certify that anyway.
Workflows fire on submit
A submission can send email, post to Slack, hit a webhook, or run a multi-step workflow with conditions. Each run is logged with its result, so a failed delivery is visible rather than silent.
It inherits your brand kit
A new form is seeded from the site’s brand kit at creation, so the first version already looks like your site instead of like a generic form. Restyle it later in the builder and the change reaches live pages without you touching the embed again.
More detail in the Help Center: Forms · Embedding on your website
Things worth knowing about any website
- Astro bundles any <script src> that carries no other attribute — which is exactly the shape of the snippet. Add the is:inline directive so Astro leaves it alone.
- Hugo strips raw HTML out of Markdown unless markup.goldmark.renderer.unsafe is true. Put the tag in a layout or partial instead of in a content file.
- In React, dangerouslySetInnerHTML never executes a script — that is the HTML spec, not a React bug, and it fails silently. Render the placeholder <div> in JSX and load the script separately. In Next.js use next/script: lazyOnload in app/layout.tsx for a floating launcher, the default afterInteractive on the page itself for an inline widget.
- If your site sends a Content-Security-Policy, the directive that catches people out is style-src. The loader builds its stylesheet at runtime — createElement("style"), set textContent, append to <head> — which counts as an inline style, and it sets no nonce anywhere. So it needs 'unsafe-inline' there or the widget loads and renders completely unstyled. A nonce-only style-src breaks it, and 'strict-dynamic' does not help because that is a script-src feature. You also need the Sorraia API origin under connect-src and the host printed in your snippet under script-src.
- Because the widget renders into your DOM rather than an iframe, your own CSS reaches it — an aggressive global rule on form, input or button can restyle it, and an ancestor with overflow:hidden can clip it. That is the trade for having no sandbox: no isolation bugs, but no isolation either.
Questions
Where do the submissions go?
Into your Sorraia dashboard, immediately. You can search and filter them, see which site each came from, and route them onward with a workflow — email, Slack, or a webhook. CSV export of the current view is available on paid plans. Nothing is posted to a third-party form service in between, and there is no cap on how many submissions you can receive, on any plan.
Can I change the form after I have embedded it?
Yes, and you never re-paste the snippet. The embed loads the current version of the form each time, so editing fields, wording or styling in the builder updates every page it is on. That is the point of a script tag over a copy-pasted HTML form.
Do I need to install anything?
No. There is no plugin, no package and no build step — the whole install is one script tag. It works on a static site, a hand-written page, a Rails or Laravel template, an SSG like Hugo or Eleventy, or a React app, because it is plain HTML from the browser’s point of view.
Will it work behind a Content-Security-Policy?
Yes, with three directives. Allow the host printed in your own snippet under script-src, allow the Sorraia API origin under connect-src, and allow 'unsafe-inline' under style-src — the loader builds its stylesheet as an injected style element and sets no nonce, so a nonce-only style-src leaves the widget rendered but completely unstyled. If your widget uses a Google webfont, also allow fonts.googleapis.com under style-src and fonts.gstatic.com under font-src.
Add a contact form to any website
Build it in Sorraia, paste one line into your site, and change it later without touching the embed again.