Custom JavaScript

Custom JavaScript is available on all plans, including Free.

Start Here

Overview

The Custom JavaScript feature allows you to add JavaScript code to your forms. Use it for custom analytics beacons, loading third-party scripts, or any other functionality that requires JavaScript.

Sandboxed execution — For security, your code runs in an isolated sandbox. It cannot access the parent page, its DOM, its cookies, or globals defined by other scripts (such as fbq or gtag from the built-in Meta Pixel / Google Analytics integrations). To fire Meta Pixel or GA4 events, use the built-in Meta Pixel and Google Analytics fields instead—they already fire page view and submission events for you.

Why This Matters

Sometimes you need tracking or functionality that’s specific to your stack. Custom JavaScript lets you add code to your forms—send conversion beacons to your own endpoint, or load third-party scripts inside the sandbox—without touching OrbitForms’ built-in tracking.

Use Cases

Analytics Beacons

Send custom events to your own tracking endpoint

Third-Party Scripts

Load external scripts inside the sandbox

Custom Logic

Run code when the form loads

Built-in Tracking

Use the Meta Pixel, GA4, GTM, and Cometly fields for standard events

Setup Guide

Open your form settings

Go to your form in the dashboard and click on the “Integrate” tab.Forms → Select form → Integrate tab

Find Custom JavaScript

Scroll down to the Custom JavaScript section under Tracking & Analytics.Scroll to "Custom JavaScript" section

Enter your code

Paste your JavaScript code into the text area. The code will execute when the form loads.Paste code into text area

Save your changes

Click Save. Your custom JavaScript will now run on your form.Click "Save" button

Code Examples

Form Slug Variable

Your code has access to a formSlug variable containing the current form’s slug:

// Use the injected formSlug variable
console.log('Form slug:', formSlug);

Send a Beacon to Your Own Endpoint

Send form-load events to your own tracking endpoint:

// Notify your own analytics endpoint when the form loads
fetch('https://your-endpoint.example.com/track', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    event: 'form_loaded',
    form_slug: formSlug,
    timestamp: new Date().toISOString()
  })
}).catch(function(err) { console.warn('Beacon failed:', err); });

Debug Logging

Log when the form loads (for testing):

// Debug: Log form load
console.log('Orbit form loaded at:', new Date().toISOString());
console.log('Form slug:', formSlug);

Load Third-Party Script

Dynamically load an external script (it loads inside the sandbox):

// Load a third-party script
(function() {
  var script = document.createElement('script');
  script.src = 'https://example.com/widget.js';
  script.async = true;
  document.head.appendChild(script);
})();

What the Sandbox Blocks

To protect your respondents, certain code is rejected before it ever runs. The following patterns are blocked:

eval(), new Function(), setTimeout('...') / setInterval('...') with string arguments
import statements and dynamic import()
<script> tag injection, innerHTML / outerHTML assignment, document.write()
Inline event handlers (onclick=, etc.) and javascript: / vbscript: URLs
Accessing document.cookie or globalThis
Redirecting the page (location.href = ..., window.location = ...)
atob(), String.fromCharCode, Web Workers, URL.createObjectURL
Code longer than 50 KB

Code containing any of these patterns is silently skipped—nothing runs.

Important Notes

Avoid duplicate tracking — If you’re tracking page views or submissions, use the built-in Meta Pixel, GA4, GTM, or Cometly fields rather than duplicating that logic in Custom JavaScript. This will cause duplicate events.

When code runs — Custom JavaScript executes once when the form page loads, inside the sandbox. If you need to run code on form submission, consider using webhooks or workflows instead.

Security — Only add JavaScript from sources you trust. Malicious code could affect your form’s functionality or compromise user data.

Troubleshooting

Code not running?

Open browser developer tools (F12) and check the Console tab for errors. Syntax errors will prevent your code from executing.

Third-party function not defined?

Globals from other scripts on the page (like fbq or gtag) are not available inside the sandbox, even if the corresponding integration is enabled. To fire Meta Pixel or GA4 events, use the built-in integration fields on the same Integrate tab instead of Custom JavaScript.

Debugging tips

Use console.log() statements to verify your code is running and inspect variable values in the browser console.

Best Practices

Always test your code on a test form before applying to production
Use try/catch blocks to prevent errors from breaking your form
Check if third-party functions exist before calling them
Keep your code minimal - complex scripts may slow down form loading
Document your code with comments for future reference

Ready to Add Custom Tracking?

Add custom JavaScript to your forms and unlock unlimited tracking possibilities. Get Started →

Getting Started

Notifications

CRMs

Email Marketing

Spreadsheets & Databases

Enrichment

AI Support

Analytics

Email & Calendar

Video Conferencing

Messaging

Automation

Custom Integrations

Start Here

Overview

Why This Matters

Use Cases

Analytics Beacons

Third-Party Scripts

Custom Logic

Built-in Tracking

Setup Guide

Code Examples

Form Slug Variable

Send a Beacon to Your Own Endpoint

Debug Logging

Load Third-Party Script

What the Sandbox Blocks

Important Notes

Troubleshooting

Best Practices

Ready to Add Custom Tracking?

​Start Here

​Overview

​Why This Matters

​Use Cases

Analytics Beacons

Third-Party Scripts

Custom Logic

Built-in Tracking

​Setup Guide

​Code Examples

​Form Slug Variable

​Send a Beacon to Your Own Endpoint

​Debug Logging

​Load Third-Party Script

​What the Sandbox Blocks

​Important Notes

​Troubleshooting

​Best Practices

​Ready to Add Custom Tracking?

Start Here

Overview

Why This Matters

Use Cases

Setup Guide

Code Examples

Form Slug Variable

Send a Beacon to Your Own Endpoint

Debug Logging

Load Third-Party Script

What the Sandbox Blocks

Important Notes

Troubleshooting

Best Practices

Ready to Add Custom Tracking?