# Site builders

> Use Ikiform from no-code site builders that let you paste custom HTML, such as an embed or code block.

Ikiform works anywhere you can put a real HTML `<form>` on the page, because a plain form post needs no script. Most site builders offer an embed, code or custom HTML block. Paste a form into it and point the `action` at your endpoint.

> This only works when the builder renders your HTML as-is. A builder's own form widget usually posts to the builder's servers instead; use it only if it lets you set a custom action URL with the POST method.

## The embed

`Custom HTML block`:

```html
<form action="https://ikiform.com/f/frm_xxxxxxxxxxxxxxxx" method="post" target="_top">
  <label>
    Email
    <input name="email" type="email" required />
  </label>
  <label>
    Message
    <textarea name="message"></textarea>
  </label>
  <input name="_gotcha" type="text" tabindex="-1" autocomplete="off" hidden />
  <button>Send</button>
</form>

<style>
  form { display: grid; gap: 12px; max-width: 420px; font: inherit; }
  label { display: grid; gap: 4px; }
  input, textarea { font: inherit; padding: 8px 10px; border: 1px solid #d4d4d4; border-radius: 6px; }
  button { font: inherit; padding: 8px 14px; border-radius: 6px; border: 0; background: #111; color: #fff; }
</style>
```

- Builders often place custom code inside an iframe. `target="_top"` makes the thank-you page open in the whole window instead of inside the small frame. If the builder's frame doesn't allow top navigation, the result shows inside the frame.
- Set **Redirect after submit** on the form to send people back to a thank-you page on your site.
- Styles inside the block may not inherit your site's styles; the `<style>` above gives the form a clean starting point.

## Allowed domains

If you set allowed domains, list every address the site is served from: your custom domain and the builder's preview or staging domain. Posts from a domain that isn't listed are stored as spam by default, and show the reason `origin_mismatch` in the dashboard.

Some builders render embeds in a frame whose `Origin` is `null`. Ikiform then falls back to the `Referer`. If the builder strips both, posts can't be matched to a domain; leave allowed domains empty for that form, or set the mismatch policy to spam rather than reject.

## Human check

The **Ikiform** human check works with no extra code: the browser navigates to a short check page on ikiform.com, which sends the post on. Avoid **Your own Turnstile keys** in builders, since that needs Cloudflare's script on the page.