Public forms on Experience Cloud

The package includes a subscriber-facing component, Sliick Experience Form, that renders forms on Experience Cloud pages. This is the option to use for a form behind portal login, and one of the options for a public form.

Place the component

1. Open Experience Builder for the target site.
2. Navigate to the page where the form should appear.
3. Drag Sliick Experience Form from the component palette onto the page.
4. Set Form External ID to the target form’s external ID.
5. Optionally configure Source Channel, Submit Button Label, and Success Message.
6. Publish the site.

One page can serve every form

Leave Form External ID blank and the component reads the form’s external ID from the page URL’s ?form= parameter instead. Pair that page with an org-wide base URL of https://<your site>/forms/f?form={form} on the Admin Dashboard, and every form in the org gets a working share link without another page being built.

Set the property when a page is meant to serve exactly one form. Leave it blank for the shared page.

The site itself must be public

An Experience site does not serve pages to visitors who are not logged in until it is both published and available to them. Publishing alone is not enough:

• Experience Builder, Settings, General, Public Access must be on. With it off, a visitor hitting the page is redirected to the login screen or gets a Page Not Found.
• The site must be Live under Administration, Settings, Activate, not Under Construction.
• Custom pages are served under /s/, so the address is https://<domain>/<prefix>/s/<page>.

A public form here needs more than the site being live. It also needs a permission set assignment and a sharing rule. Work through Guest access for public forms before testing one.

The hidden field on public forms

Public forms include a hidden field that respondents never see. A script that fills in every input on the page will fill this one too, and a submission that arrives with it completed is discarded: the sender gets an ordinary-looking confirmation and nothing is recorded. There is nothing to configure.

This catches indiscriminate form-filling bots without putting anything in front of real respondents. It is not a general spam filter, and it does not stop a script written deliberately against your form. There is also no rate limiting in the package, so a form that attracts sustained automated traffic needs a control in front of it rather than inside it.

A form served from your Sliick Edge address gets this same hidden field, plus a Cloudflare Turnstile check on every submission. See Bot protection is automatic.