Publishing, Prefill Links, and Password Protection

Toggle Published in the form editor or design panel. While unpublished, the public link shows a "not available" message instead of the form — this lets you build and preview a form safely before it's live.

Share a link with some answers already filled in by adding query parameters in the form /f/slug?<fieldId>=value&... (separate multiple checkbox values with a comma). Rather than constructing this by hand, use the Copy prefill template button in the Design panel, which copies a ready-to-edit link containing every field's id.

From the form's settings, set a password to require it before the public form loads — useful for internal surveys or forms shared with a specific group rather than the open web. Clear the password field to remove protection again.

Every published form's public URL can be embedded directly on your own site in an <iframe> — this works for any form, including a contact form, a lead-capture form, or a survey, and needs no plugin or extra setup on Orbiform's side. Orbiform's security headers explicitly allow public form pages (/f/<slug>) to be framed from any origin, unlike the rest of the site.

<iframe
  src="https://orbiform.cc/f/your-form-slug"
  width="100%"
  height="720"
  style="border:0"
  title="Contact form"
></iframe>

Copy your form's slug from its public link (the part after /f/) and drop it into the snippet above. A few things to keep in mind when embedding:

• Set a fixed height that comfortably fits your longest question — an iframe can't auto-resize to its content, so leave some headroom or use a taller value for long forms.
• Password-protected forms still prompt for the password inside the iframe, so it's safe to embed a restricted form on a page that isn't itself private.
• Prefill query parameters (see above) work the same way inside an embed — append them to the src URL to pre-fill fields for visitors arriving from a specific page or campaign.
• If your site runs on a page builder (Webflow, WordPress, Framer, Squarespace, and similar), paste the same snippet into its embed/HTML/custom-code block — there's nothing Orbiform-specific about it.

A form's public URL works anywhere a link works — paste it into an email, a social post, or a QR code for print and in-person collection (Orbiform partners with QR Rapid for that). Because it's a single stable URL rather than a generated widget, the same link, prefill parameters, and password protection apply no matter where you share it — embedded, linked, or scanned.

Toggling Published off immediately shows the "not available" message on the public link and any embeds — existing responses, comments, and analytics stay intact and reappear as soon as you republish. Nothing about the form's slug or share link changes when you unpublish and republish it later.