HTML Form Builder (Your Google Sheet as the Backend)

About the HTML Form Builder (Your Google Sheet as the Backend)

Build a web form by pressing or dragging fields into place — short and long answers, email, phone, numbers, dates, dropdowns, single and multiple choice, consent boxes, ratings, file uploads and hidden values — then add steps, conditional fields (“show this only when…”), checks for each answer, hidden UTM values and spam protection. A live preview runs the real form, so you can try every step and see the exact row your Sheet would get.

The builder writes two things: the form (HTML, CSS and a small script, as one snippet or as files for strict Content-Security-Policies) and a Google Apps Script that you add to your own Google Sheet. Each answer then goes from your visitor’s browser straight to that Sheet — optionally with an e-mail to you from your own Gmail and uploads saved in your own Drive. MySmartCoPilot hosts nothing and never sees the answers.

Common uses

• A contact or lead form on a website, a landing page or a Carrd/Wix/WordPress/Webflow site, with UTM values for campaign tracking.
• Admission enquiries for a school or coaching centre, with steps and an optional document upload.
• Event registrations with ticket types, guests and dietary needs.
• Customer feedback with satisfaction and recommendation scales.

How the answers reach your Sheet

When someone sends the form, its script posts the answers as JSON to your Apps Script web app, as plain text (a “simple” cross-site request: the browser sends it without asking first, which Apps Script could not answer). The script’s doPost checks the answers again with the same rules as the form, waits for a lock so two answers at the same moment cannot collide, and adds a row. Apps Script returns its answer through a redirect to script.googleusercontent.com, which the form follows (Google: Content Service).

• Execute as: Me runs the script under your account, so it can write to your Sheet; Who has access: Anyone lets the form post without a Google sign-in (Google: Web Apps).
• The script asks only for the permissions the form needs: e-mail sending only with notifications, Drive only with uploads, external requests only with Turnstile.
• Text that starts with =, +, - or @ gets an apostrophe in front, so an answer can never become a formula in your Sheet.
• Without JavaScript in the visitor’s browser the form still posts the classic way, and the script answers with your thank-you text.

Spam protection

• Bot trap (on by default): a field people never see — anything typed into it marks a bot — and answers sent within two seconds of opening the page are ignored. Bots get a normal thank-you, so they learn nothing.
• Cloudflare Turnstile: a check on your page that tells people from bots, verified by your script with Turnstile’s siteverify service. Turnstile’s no-cost plan covers up to 20 widgets with unlimited checks (Turnstile plans). The site key goes into the form; the secret key goes only into the script’s properties (Project Settings → Script properties → TURNSTILE_SECRET), never into the page. Each check’s token is valid for 5 minutes and can be used once, so the form renews it after a failed attempt (Turnstile: server-side validation).

Accessibility of the forms it makes

Every form follows WCAG 2.2 for forms: each field has a visible label tied to it, choices sit in a fieldset with a legend, required fields are marked in text and with required, problems are shown in words next to the field (linked with aria-describedby) and listed at the top, where the focus goes, with links to each field. Steps move the focus to the step’s heading; sending and its result are announced. Inputs and buttons are at least 44 px tall, focus is always visible, and Set up shows the colour contrast of your theme for text, buttons, borders and errors.

Limits to know

• E-mails: scripts may send to 100 recipients a day from a personal Google account and 1,500 from Google Workspace (Google’s quota page, which says these can change). The notification is skipped when the quota is used up; the answer is still saved.
• Uploads travel inside the answer, so keep files small (up to 10 MB each here) and test with your largest file. They are saved privately in a folder of your Drive and linked in the row.
• Confirmation e-mails to the person who answered contain only your own text — never their answers — so nobody can use your form to send their words from your account. Use them with Turnstile on.
• In some Google Workspace organisations the administrator does not allow web apps for “Anyone”; then the form cannot post to your Sheet — ask the administrator, or use a personal Google account for the Sheet.

Limitations

• The tool writes the form and the script; you deploy the script in your own Google account (a one-time, five-minute set-up) and paste the form into your site.
• Answers are stored only in your Google Sheet; there is no dashboard or response viewer here — the Sheet is the dashboard.
• Payments, signatures and logins are not part of the forms.
• The preview needs the internet (it runs on MySmartCoPilot’s sandbox address); building, the code and the downloads work without it.
• Your form is saved in this browser only. Use Save form file to keep it, or to open it in another browser.

Privacy

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot. The live preview runs in an isolated frame loaded from a separate MySmartCoPilot address; your form and test answers are handed to it inside your browser and never uploaded. Building, the code and the downloads work offline. Forms you publish send their answers straight from your visitors to your own Google Sheet.