Embedding a form on your own site
A form on your Sliick Edge address can be embedded in a page on your own website. This page is for the admin who turns embedding on and for the web developer who owns the page it goes on. Hand the whole page over: the failure everyone hits, a blank rectangle where the form should be, has causes on both sides of that line.
What you get
Section titled “What you get”The Share tab gives you a single snippet: a plain <iframe>. There is no script-loader snippet, and its absence is deliberate rather than pending. So everywhere this page says “the embed”, it means the frame, and the limits below follow from that.
Three things have to be true first
Section titled “Three things have to be true first”The Share tab refuses to show a snippet until the form can actually be framed, and it gives one reason at a time, in this order.
1. The form must not collect a payment. A form with a Stripe payment field cannot be embedded: card entry inside a frame inside someone else’s page is not confirmed to work, and a broken checkout is worse than a link. Share the public link instead.
2. The form must be on your public Sliick Edge address. Tick Allow on your public Sliick Edge address in Form settings, Availability. Without it there is no address to put in the snippet. See Hosting on Sliick Edge.
3. At least one site must be on the embed allowlist. Set it in Form settings, Availability, under Embed allowlist.
A blank allowlist permits nobody, not everybody. An empty list means the form renders as a blank frame on every site, including yours. There is no “allow all” value and there is not meant to be.
What the embed allowlist accepts
Section titled “What the embed allowlist accepts”Exact origins only. Wildcards are refused. The grammar that would accept https://*.acme.com also accepts a wildcard over shared hosting, where every customer has a subdomain of the same host, so separating your own subdomains from anyone’s page is not something the list can be trusted to do. List the addresses you actually use.
An origin is a scheme, a host and an optional port, and nothing else: no path, no trailing slash.
| Value | Accepted | Why |
|---|---|---|
https://www.acme.com | Yes | Scheme and host |
http://dev.acme.com:8080 | Yes | A port is part of an origin, and http is allowed |
https://acme.co.uk | Yes | Any number of labels |
https://acme.com, https://www.acme.com | Yes | Comma separated, and these are two different origins |
https://*.acme.com | No | Wildcards are refused |
https://www.acme.com/careers | No | A path is not part of an origin |
www.acme.com | No | The scheme is required |
http://localhost:3000 | No | The host needs at least one dot |
http://127.0.0.1:3000 | No | A bare IP address is not accepted |
Local development needs a dotted hostname. http://dev.localhost:3000 is accepted and resolves to your own machine in every current browser, so that is the spelling to use, or point a dev.acme.com hosts entry at your loopback address.
Framing is not fetching. The embed allowlist governs who may put this form in a frame. The separate CORS allowlist governs who may fetch a form’s data from their own script, and that one does accept a single leading wildcard subdomain such as https://*.acme.com, though never a bare top-level domain. If you are embedding, you want the embed allowlist and you do not need the CORS one.
The snippet
Section titled “The snippet”Copy it from the builder’s Share tab. It looks like this:
<iframe src="https://acme.Sliick.net/embed/contact-us"
width="100%" height="640" style="border:0"
title="Contact us" loading="lazy"></iframe>srcis your form’s embed address. Paste it exactly as the Share tab gives it to you.heightis a fixed pixel height, estimated from the tallest page of your form. You will probably want to change it, because it is an estimate and the frame cannot correct itself.width="100%"fills the container. Size the container, not the frame.titleis the form’s name, and it is mandatory: an untitled frame is a dead end for anyone using a screen reader, and it is the failure that looks perfect on screen. Change the wording if you like, but do not remove the attribute.loading="lazy"defers loading until the frame is near the viewport. Safe to remove if the form is the point of the page.
Content Security Policy on your own site
Section titled “Content Security Policy on your own site”If your site sends a Content Security Policy, the browser refuses to load the frame unless the Sliick Edge host is allowed as a frame source. Add frame-src https://acme.sliick.net;, substituting the host from your own snippet.
If your policy has no frame-src directive, the browser falls back to default-src, so a restrictive default-src blocks the frame even though nothing in the policy mentions frames. Adding frame-src is the fix either way.
You do not need
script-src,style-src,connect-srcorfont-srcentries for the form. Everything the form loads happens inside the frame’s own document, which is governed by its own policy, not yours. Your policy only decides whether the frame may exist at all. Teams who add four directives and still see a blank frame have usually missed the one that is actually consulted.
What the embed cannot do
Section titled “What the embed cannot do”- It cannot resize itself. The height is whatever the snippet says. Multi-page forms are the awkward case, because pages differ in height: size for the tallest page you care about.
- It cannot send someone to your own thank-you page after they submit. The success message appears inside the frame. If a post-submit redirect matters, use the public link on its own page instead.
- It cannot carry prefill or page analytics in from your page, because the frame does not know what the surrounding page knows.
Point 3 has an exception worth knowing. A signed prefill link does work on an embedded form: what the frame cannot do is build one for you. Put the prefill address in the src yourself and the form loads prefilled exactly as it would on its own page.
Prefill and resume links in an embed
Section titled “Prefill and resume links in an embed”Both work. Two things to know first.
A link that carries a reference is readable. Prefill and resume references travel in the address, so anything that logs, forwards or indexes full addresses, such as an analytics tool, a proxy, or a case comment, captures it. The public address clears the reference from the visible address once it has been read, which stops it persisting in browser history, but it cannot un-log an address your own systems already recorded.
Do not paste a respondent’s resume link into anything that stores addresses. A resume link is that respondent’s answers. Send it to them and nowhere else.
A freshly minted link may take a second to become usable. If you mint one and open it immediately, which is exactly what you do when testing, the first read can restore nothing. The form says it is restoring your saved answers and retries by itself rather than claiming the link has expired.
Cookies
Section titled “Cookies”The embedded form sets one cookie, and its only purpose is keeping a respondent on the same variant of an A/B experiment if they reload the page mid-form. It is not used for tracking, profiling, advertising, or identifying a respondent across sites, and blocking it degrades that stickiness and nothing else: the form loads, validates, submits and confirms with no cookies at all.
The frame is blank
Section titled “The frame is blank”Four causes, each with a different fingerprint.
| What you see | Cause | Fix |
|---|---|---|
| The Share tab shows no snippet at all, with a message | One of the three prerequisites above | Do what the message says. It names exactly one, and it is the one that matters |
Blank frame, and the browser console names frame-src and your own site’s policy | Your site’s Content Security Policy | Add frame-src for your Sliick Edge host |
Blank frame, and the console names frame-ancestors or refuses to display | The embed allowlist | Add the exact origin of the page doing the embedding, scheme included |
| The frame loads and the form says the link expired | A prefill or resume link that is genuinely finished | Not an embedding problem. Issue a new link |
Two notes that save time: the origin on the allowlist is the origin of your page, not of the form, and acme.com and www.acme.com are different origins, so list both if your site answers on both. If the frame is blank and the console says nothing at all, check that the address is exactly what the Share tab produced: a retyped address is the one cause with no diagnostic.