Website Forms to WhatsApp and Google Sheets with Apps Script

Many small businesses in Indonesia sell through WhatsApp, which makes sense because that's where customers already are. The catch is that would-be buyers and resellers often open with a quick 'hi' and no details at all. The admin has to ask again for their name, city, and needs, and there's no tidy record of who has shown interest.

A low-cost fix is a website form that does two things at once: it opens WhatsApp with a fully prefilled message, and it logs the details to the owner's Google Sheet using Google Apps Script. No server of your own, and no paid CRM subscription.

The flow, from form to spreadsheet row

1. A visitor fills in a short form on your website: name, WhatsApp number, city, and what they need.
2. When they press submit, the site builds a WhatsApp message from those answers and opens a chat with your business number. The visitor just taps send.
3. At the same moment, the form data is posted to an Apps Script web app attached to your spreadsheet.
4. The script checks the entry, rejects anything suspicious, and appends a new row to the sheet.
5. Optionally, the script also emails a notification to the owner.

Apps Script is Google Sheets' built-in way to run small scripts. It's installed under the business owner's Google account, so the spreadsheet and its data stay yours, not the developer's.

A real example: Devans Egg's partner forms

Devans Egg is one of our clients, a salted-egg business from Cirebon that sells over WhatsApp. On their website, one form component serves four purposes: reseller sign-ups, business partnerships, free product testers, and a giveaway. Each form type has its own required fields, but the code is shared, which keeps maintenance simple.

After submitting, WhatsApp opens with a ready-to-send message. When the Apps Script endpoint is set in the site configuration, the entry is also logged to the owner's Google Sheet with spam checks, plus a duplicate check for giveaway sign-ups. Giveaway sign-ups are only accepted during a set period, and the script rejects them outside it. The result is a list of prospective partners the owner can filter by city or form type, instead of scrolling back through chat history.

Stopping spam with a honeypot and a minimum fill time

As soon as a form endpoint is public, bots will find it. Two simple techniques stop most spam without bothering real visitors:

• Honeypot. The form includes an extra field hidden from humans. Real visitors never see or fill it, but bots tend to fill every field. If that field has a value, the submission is ignored.
• Minimum fill time. A person needs a few seconds to type a name and number. Bots often submit instantly. Anything sent too fast is treated as a bot.
• Server-side validation. Don't rely on browser checks alone. The script behind the spreadsheet still verifies required fields and the WhatsApp number format.

One small trick: when a submission looks like a bot, return a response that appears successful but save nothing. The bot doesn't know it was rejected, so it has no reason to try something else.

Keeping the data tidy and safe

• Store the WhatsApp number column as text so the leading zero isn't dropped.
• Stop entries that begin with =, +, -, or @ from being read as spreadsheet formulas.
• Use a lock in the script so two submissions arriving together don't overwrite each other.
• Add columns for the admin to fill in, such as status, lead quality, and notes.
• Share the sheet only with specific staff emails, never 'anyone with the link', and turn on two-step verification for the owner's Google account.

This data includes names and WhatsApp numbers, which is personal data. State in your website's privacy policy that it's stored in your business's Google Sheet, keep it only as long as you need it, and read up on Law No. 27 of 2022 on Personal Data Protection (UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi). If you're unsure about your obligations, consult a professional.

Limits worth knowing

• Apps Script has daily usage quotas, including how many emails it can send. For events with many sign-ups, like a giveaway, it's wise to switch off per-entry email alerts.
• A WhatsApp link only opens a chat with the message filled in. The visitor still has to press send, so the spreadsheet is the more reliable record.
• Sending WhatsApp messages automatically from a system requires the WhatsApp Business Platform (Cloud API), which charges per message and requires business verification. For a small business, email alerts are usually enough.
• A spreadsheet isn't a full CRM. Once you get dozens of leads a day handled by several people, it's time to look at a system with pipeline stages and follow-up tasks.

Next steps

1. Decide which form types you need, such as orders, resellers, or partnerships.
2. For each type, keep the required fields to a minimum. Every extra field gives visitors a reason to quit.
3. Set up the Google Sheet under the business's Google account, not a staff member's personal one.
4. Draft a polite, complete WhatsApp message template so the admin can reply without asking again.
5. Review the sheet weekly and fill in the status column, so you know how many prospects became buyers or partners.