Connecting Your Website to a CRM

What the connection should do

Write down the outcome before choosing a tool. A typical brief: each enquiry creates or updates a contact in the CRM, with the message, the service asked about, the page the form was on and the campaign that brought the visitor; it is assigned to the right person; and a member of staff is alerted. List every form on the site, such as contact, quote request, newsletter sign-up and booking, because each may need different fields and a different follow-up.

Also decide which system is the source of truth. If a salesperson corrects a phone number in the CRM, a later form submission should not quietly overwrite it with an old one.

Three ways to connect a form

There are three common routes. HubSpot's forms documentation shows them clearly: forms built in the CRM and embedded on external pages, a tool that captures submissions from your own HTML forms on tracked pages, and a "Submit data to a form" endpoint for sending submissions from your own code. Other CRMs use other names for the same ideas.

• An embedded CRM form. The quickest to set up, and the CRM handles storage and notifications. You have less control over design, accessibility and spam protection, and the form usually loads extra scripts on your page.
• Capturing your own form. Your form keeps its design, and a CRM script reads what is submitted. It depends on that script running in the visitor's browser, which consent settings or blockers can prevent.
• A server-side connection. Your form submits to your own site, which checks the data and then sends it to the CRM's API, directly or through a webhook to an automation tool. This gives the most control and keeps API keys off the page, but someone has to build and maintain it.

For how APIs, webhooks and keys work, see our guide to APIs and integrations. Whatever the route, the checks in our guide to stopping contact form spam should run before anything reaches the CRM, or junk enquiries will fill it.

Field mapping

Field mapping means deciding which form field fills which CRM field (often called a property). Make a simple table with three columns: the form field, the CRM field, and the format the CRM expects. Points that often go wrong:

• Names: a single "Name" box on the form, but separate first and last name fields in the CRM.
• Drop-down lists: the form's options, such as services or budgets, must match the CRM's allowed values exactly, or the value is rejected or dropped.
• Phone numbers and countries: agree one format, so records can be searched and matched.
• Required fields: a field the CRM requires but the form does not ask for will cause submissions to fail.
• The message itself: long free text often belongs in a note or activity on the record, not a short text field.

Map only what you need. The UK GDPR's Article 5 says personal data must be "adequate, relevant and limited to what is necessary" for the purpose, its "data minimisation" principle.

Duplicates

People fill in forms more than once, from different pages and sometimes with different email addresses. Decide what should happen. HubSpot's help page on deduplicating records is a useful example of how CRMs handle it: it "automatically deduplicates contacts using email addresses, and companies using domain names", including records created by form submissions. Check what your own CRM uses as the matching key.

Questions to settle with whoever builds the connection:

• When an email address already exists, does the submission update the contact, add a new enquiry to it, or both?
• Which fields may a form overwrite, and which are protected because your team maintains them?
• Can an empty form field ever blank out a value already in the CRM? It should not.
• Who reviews and merges the duplicates that automatic matching misses?

Recording consent

Not every enquiry needs marketing consent. Answering someone who asked for a quote is a different purpose from adding them to a newsletter. The UK GDPR's Article 6 lists the lawful bases, including processing "in order to take steps at the request of the data subject prior to entering into a contract", and consent "for one or more specific purposes". Keep the two apart in the CRM: an enquiry is not a marketing opt-in.

Where you rely on consent, Article 7 says "the controller shall be able to demonstrate that the data subject has consented". It also says people may withdraw consent at any time, and "it shall be as easy to withdraw as to give consent". So the connection should store, with each contact:

• whether the marketing box was ticked (it should start unticked);
• the wording shown next to it, or a version reference to that wording;
• the date and time, and the form and page it came from;
• any later withdrawal or unsubscribe, which must reach the CRM and your email platform.

Our guide to email marketing rules covers what consent has to look like and which records to keep. Article 5 also requires that personal data is kept "for no longer than is necessary", so agree how long unconverted leads stay in the CRM.

Capturing where the lead came from

A CRM record is more useful when it shows how the person found you. Google Analytics' help page on URL builders explains campaign tags, known as UTM parameters, added to the links you use in ads, emails and social posts. The main ones are utm_source (for example google or newsletter), utm_medium (for example cpc or email) and utm_campaign. Google says to "always use utm_source, utm_medium, and utm_campaign", and to keep a strict, case-sensitive naming convention so one campaign does not split into several rows.

Analytics reports these tags in aggregate, but they do not reach the CRM by themselves. A common approach:

• When a visitor lands, a small script reads the tags from the address. Browsers provide URLSearchParams for this.
• The values are kept for the visit, so they are still known when the visitor reaches the contact page a few clicks later.
• The form sends them in hidden fields, along with the landing page, and the connection maps them to CRM fields.

MDN warns that hidden field values are "visible—and can be edited" in the browser's developer tools, so treat them as helpful labels, not trusted data. Storing them in a cookie or local storage may need consent under cookie rules; see our guide to cookie consent banners. For using this data to judge which channels bring real business, see turning a B2B website into a lead source.

When the connection fails

CRM connections break quietly: an expired key, a renamed field, a new required field, or the CRM briefly unavailable. The visitor sees "thank you" while the enquiry goes nowhere. Plan for it:

• Keep an email notification or a copy of each submission on the website, so nothing is lost if the CRM call fails.
• Retry failed sends and alert someone when they keep failing.
• Keep API keys on the server and give them only the permissions the connection needs.
• Send a test enquiry after any change to the form or the CRM, and check the record, the mapping and the consent fields.

A checklist

• Every form and the outcome it should create in the CRM are written down.
• The connection method is chosen, and spam checks run before data reaches the CRM.
• A field mapping table covers every field, format and drop-down value.
• Duplicate rules say which fields may be updated and which are protected.
• Marketing consent is separate from the enquiry and stored with wording, date and source.
• Campaign tags and the landing page are captured and mapped.
• Failures are caught, retried and alerted, and a backup copy exists.

Frequently asked questions

What is the easiest way to connect a website form to a CRM?

Embedding a form built in the CRM is usually quickest. It gives you less control over design, accessibility and spam checks than sending your own form to the CRM from your server.

Do I need consent to add an enquiry to my CRM?

Not always for the enquiry itself: the UK GDPR allows processing to take steps at the person's request before a contract, such as replying to a quote request. Marketing is a separate purpose, so record marketing consent separately, with its wording, date and source.

How do CRMs handle duplicate contacts?

Many match on email address. HubSpot, for example, deduplicates contacts by email and companies by domain name. Decide which fields a new submission may update and which your team protects.

How do I get UTM data into my CRM?

Read the utm_source, utm_medium and utm_campaign values when the visitor lands, keep them for the visit, and send them with the form in hidden fields mapped to CRM fields.

What happens if the CRM is down when someone submits a form?

Without a backup, the enquiry can be lost. Keep an email notification or a stored copy on the website, retry failed sends and alert someone when they keep failing.

Want your website forms connected to your CRM or email platform? We build lead capture and quote forms connected to the tools you already use, and we check the specific tools during discovery before promising an integration. See our web application development service and all our services, or email [email protected].