Forms

Gordon CRM lets you collect leads, newsletter signups, and contact requests from forms on any website, application, or platform.

Connecting forms to your CRM doesn't dictate your design — you build the form using your own website style, and submit the data to your unique Gordon CRM endpoint to automatically create or update contacts.

[SCREENSHOT PLACEHOLDER: The Forms settings dashboard showing whitelist domains and API key configurations]

Form Settings

Each form you create in your dashboard has several key settings:

Name — A display label (e.g., "Contact Us", "Newsletter Signup").
Allowed Domains — A whitelist of website hostnames authorized to submit to this form from a browser. Wildcards are supported (e.g., *.yourwebsite.com). Leave empty during testing to enable Open Mode.
API Key — A secret authorization key used for server-to-server submissions.
Require Email Verification — When turned on (default), existing contacts must click a verification link sent to their email to confirm their identity before their profile is updated. When turned off (Frictionless Mode), their profile updates instantly.
Success Redirect URL — Optional destination where browser forms should redirect the user after a successful submit.

Accepted Form Fields

You can map fields in your form to the following contact parameters:

Field	Required	Description
`email`	✅	The contact's email address. Used as the unique key in your workspace.
`first_name`	No	The contact's first name.
`last_name`	No	The contact's last name.
`phone`	No	The contact's phone number.
`is_subscribed`	No	Marketing consent flag. Accepts `true`, `"true"`, or `"on"`.
`opt_in_source`	No	Custom label for consent origin (defaults to the form ID).
`notes` / `message`	No	Freeform message. Automatically attaches to the contact record as a note.
`website_url`	No	Honeypot field. A hidden field used to trap automated spambots.

Existing Contact Verification (Double Opt-In)

To protect existing data from impersonation attacks (where a third party submits a form using someone else's email address), Gordon CRM provides settings to control how submissions from existing contacts are verified and merged:

Spam Protection Enabled

By default, Require Email Verification is enabled. When a form is submitted using an email address that already exists in your workspace:

The submission details are held securely in a pending state.
The system dispatches a verification email to the contact.
Their profile is only updated, and any linked automations are only triggered, after they click the verification link in their email.
Brand new contacts are always created and processed instantly without a verification email.

Frictionless Mode

If you turn Require Email Verification off, submissions from existing contacts bypass the verification email and update the contact instantly. To safeguard your data in this mode, Gordon CRM applies specific merge rules:

Non-Destructive Merge: The system will only fill in empty fields (such as a first name, last name, or phone number if they are currently blank). It will never overwrite existing profile information.
Consent Overwrites: Marketing subscription preferences (is_subscribed and custom opt-in sources) always overwrite existing records on bypass, ensuring the CRM captures the contact's latest explicit consent status.

Form Dashboard and Layout

The form detail page is split into two sections on desktop to help you monitor submissions and manage configuration:

Activity and Rules: The left column displays total submission metrics and a dedicated Verification Rules card. This card shows a Green Shield indicating Spam Protection Enabled or a Yellow Alert indicating Frictionless Mode (detailing the non-destructive merge safeguards).
Endpoint & Allowed Domains: The right column displays the endpoint URL, the secret API key, and whitelisted hostnames.

[SCREENSHOT PLACEHOLDER: The form details page showing the two-column dashboard layout and Verification Rules card]

Viewing Submission Details

Under the Submissions section, you can review history:

Click the Details button (eye icon) next to any submission row.
This opens a parsed view showing the submitted field values in a clean table.

Note: Internal metadata (such as tracking fields or honeypot indicators) and blank or falsey subscription flags are hidden for readability.

Automation Integration

Submitting a form can automatically trigger custom workflows in your workspace. You can set up automation rules under Automations to perform actions like:

Adding a "New Lead" tag.
Creating a follow-up task for your team.
Enrolling the contact in a welcome email campaign.

If you delete a form, any associated automation rules will also be deleted. The system will warn you before finalizing the deletion.

Permissions

Structural management of forms requires administrative access.

Role	Create & Edit Forms	View Submissions	Delete Forms
Owner	Yes	Yes	Yes
Admin	Yes	Yes	Yes
Member	Yes	Yes	No

Choose an Integration Method

Select the guide below that matches how your website is built:

HTML Embed — Squarespace, Wix, WordPress, Webflow, or any static HTML site.
React / SPA — React, Vue, Next.js, or any frontend application.
Server / API Key — Zapier, Make.com, backend scripts, or mobile apps.

Automations — Trigger tasks and emails upon form submission
Subscriptions & Consent — Understand compliance rules
Technical Reference: Forms — Database schemas, CORS headers, and rate-limiting specifications

Student Portal & Domains HTML Embed