Decide what the form needs to accomplish
Define the minimum information required for a useful response. A sales form may need a name, work email, company, team size, primary channel, and use case. A callback form may need much less. Avoid collecting sensitive detail before the business has a reason and an approved process to handle it.
Build the submission flow
- Validate fields in the browser for immediate feedback.
- Validate them again on the server and reject unexpected fields.
- Add rate limits and a quiet honeypot or equivalent spam control.
- Normalize contact information used for matching.
- Find or update the relevant contact when the rules permit it.
- Create or update the lead with source and attribution data.
- Record an activity and notify the responsible team.
- Return a reference that confirms receipt without exposing internal data.
PeopleTide’s lead capture and follow-up solution follows this model for approved website and API enquiries.
Protect the integration
Never place a broad administrator secret in public JavaScript. Use a purpose-built public endpoint with strict validation and rate limits, or submit through your own server using a credential limited to the required action. Keep error responses helpful to the user without revealing security details.
The integrations guide explains scoped keys, approved destinations, and defined operations.
Preserve useful attribution
Record the first landing page, external referrer, and permitted UTM values through the user’s session. Keep the actual form page as operational context when useful. Do not add unrelated tracking simply because the form can store more fields.
Attribution should help answer practical questions: which page led to a qualified enquiry, which campaign was supplied, and which service the visitor wanted to discuss.
Common mistakes
Avoid creating a new contact for every retry, treating the notification email as the system of record, or showing a success state before the server accepts the request. Plan for mail failure after a lead is saved and for CRM unavailability before it is saved.
Test cases
Test valid submission, missing fields, invalid email, duplicate contact, server validation, rate limiting, bot fields, network loss, CRM failure, and notification failure. Confirm attribution does not overwrite a genuine first-touch value during internal navigation.
Frequently asked questions
Should the form create a contact or a lead?
That depends on your data model. A common pattern matches or creates the contact, then creates a lead describing the current commercial enquiry.
How much attribution should be stored?
Store only the fields needed to understand the enquiry and honor your privacy notice.
What should happen after submission?
Show a clear acknowledgement, save the reference, and assign follow-up in the CRM. The broader CRM selection guide can help define ownership.