Auto Fill Embedded Forms (not on Marketo landing page)

[Eric_Salamon1]

This is a fun one. I have tried to use auto fill forms in the past and it worked, but that was because I was not embedding the form on the web site.

Environment

Right now I am working with a WordPress site, and have discovered that my predecessor really mucked it up. There were 3 outdated Marketo Plug-ins, the wrong Munchkin code and lots of additional things that brought the site performance down. On top of that all the forms were Iframed. The site also has lots of mixed content HTTP, and HTTPS, right now we are working to move to HTTPS which has issues with the Iframes, because the Marketo instance is not secured with the SSL certificate. (There is an additional cost to adding the certificate in Marketo and there is a small amount of down time.)

Embedding the forms is the solution I came up with, but they don't auto fill. This isn't a deal breaker, but I would like to make things easier for people when they fill out forms.

Research

I have been putting together some information based on the scripts and other sources I noticed:

http://developers.marketo.com/rest-api/assets/forms/examples/

http://developers.marketo.com/javascript-api/forms/

Auto populate form from Marketo cookie and auto submitting the form

http://developers.marketo.com/blog/external-page-prefill/

The concept looks secure, but the instructions for implementing them are not. Writing the JS I could probably figure out, but how would one connect the REST API to the website to pull the field data?

<script src="//app-ab14.marketo.com/js/forms2/js/forms2.min.js"></script>

<form id="formID"></form>

<script>

  MktoForms2.loadForm("Link", "Marketo Stuff", Form#,function(form) {

  var prefillFields = {

  "Email" : mktoLeadFields.email,

  "FirstName" : mktoLeadFields.firstName,

  "LastName" : mktoLeadFields.lastName,

  "Company" : mktoLeadFields.company

  };

  }

  );

</script>

This is where I got in the coding setup any additional advise would be great.

Message was edited by: Eric Salaman

[SanfordWhiteman]

but how would one connect the REST API to the website to pull the field data?

Don't do this.

Any would-be solution that makes a direct REST API call in response to ungoverned user activity can't be used in a professional environment. (No reason to mince words about such bad design.)

The concept looks secure

It's not really about security, it's about DoS vulnerability -- and the resulting effect on the reliability of this and your other integrations.

[Eric_Salamon1]

That makes sense, but do you have any other recommendations for auto filling in forms if they are embedded on the webpage. Again Iframes won't work.

[Becky_OConnor]

Hi, did you ever figure out a solution to this?  We're facing the same issue.

[Anonymous]

Like Becky, we have the same "problem". I put problem in quotes here because to me it feels more like a deficiency of Marketo. Most all of our landing pages are hosted in WordPress with Marketo embedded forms, and we're doing lifecycle nurture email campaigns to people and know exactly who they are, and yet when they click on the email Marketo asks them to fill out a form from scratch. The marketo token is on the email click URL, why doesn't Marketo connect this token to the user already in Marketo and either auto-fill or collapse the embedded form like it does with Marketo hosted landing pages? Would appreciate some help here, I don't think Marketo support even understands what we're asking ...

[SanfordWhiteman]

...or collapse the embedded form like it does with Marketo hosted landing pages?

If by "collapse" you mean Known Visitor HTML ("If Known Visitor, show Custom HTML") this ​does ​work with embedded forms just fine.

Similarly, Progressive Profiling does work with embedded forms. (I mention this because it, too, is frequently misunderstood.).

And Auto-Fill is the Marketo term for filling hidden fields from URL/Cookie values, which ​also ​works on embedded forms.

What doesn't work with embedded forms -- and I understand that this is what you're referring to, I just want to be using the correct terminology to not spread more misinformation -- is field PreFill.

But what you have to understand is the ridiculous security hole that would be opened by allowing an embedded form on any site to PreFill based on the Marketo cookie. This would allow me, if I merely had your email address, to read your data out of somebody else's Marketo instance.

What's required is a secure and scalable method -- which of course does exist, it just isn't a Marketo built-in feature -- where sites with embedded forms must be opted-in by the owner of the Marketo instance.

[Anonymous]

Thanks Sanford, I'm a terminology purist but new to Marketo so appreciate you breaking it out like this. So what we're looking for is Known Visitor HTML: when someone clicks on an email link, we want the embedded form (on a WordPress page) to recognize the user from only the marketo token on the URL (no cookie), and present a "Download" button instead of the full form + Download button. The forms we currently have do recognize Known Visitors and collapse the form when there is a cookie present, but don't when loaded solely with the Marketo token. The main use case is if a Known User clicks on an email from a different device than they used to initially become a Known User or have cleared cookies, and in the case where we know the user in Marketo but they are "cold" in that they never filled out a form and were cookied by Marketo.

Maybe we're missing something simple in configuration? We're open to and capable of customizing the embedded JavaScript if needed.

I definitely appreciate the security risks associated with being able to "pull" arbitrary Marketo data via JavaScript, which is what PreFill of embedded forms would amount to. Not looking to do that!

Thanks for your help.

[SanfordWhiteman · Accepted solution]

So what we're looking for is Known Visitor HTML: when someone clicks on an email link, we want the embedded form (on a WordPress page) to recognize the user from only the marketo token on the URL (no cookie), and present a "Download" button instead of the full form + Download button. The forms we currently have do recognize Known Visitors and collapse the form when there is a cookie present, but don't when loaded solely with the Marketo token. The main use case is if a Known User clicks on an email from a different device than they used to initially become a Known User or have cleared cookies, and in the case where we know the user in Marketo but they are "cold" in that they never filled out a form and were cookied by Marketo.

Maybe we're missing something simple in configuration? We're open to and capable of customizing the embedded JavaScript if needed.

Yes, known Visitor HTML works based on either the runtime associator token (mkt_tok) or the Munchkin cookie (_mkto_trk). It's not necessary to load Munchkin nor have an existing cookie.

You don't any custom JS to make this work unless you have some other custom JS that's messing it up!

Please provide your URL so I can inspect it.

[Anonymous]

OK, so in an email sent to a known test user we have this link, to a WordPress landing page with embedded form:

https://www.postup.com/audience-development-solution-guide/?mkt_tok=eyJpIjoiWlRZNVpqSXpNamRtTWpKaiIs...

When clicking in Chrome where I'm already cookied, I get the "Welcome back" collapsed form, a one click download.

When clicking to open in Chrome Incognito (simulating email click from another device or cleared cookies), I get the full, blank form.

Using the same mkt_tok and substituting a Marketo hosted landing page (info.postup.com), when clicking Chrome Incognito I get a (partially) Pre Filled form:

http://info.postup.com/EB.PUAudienceDevelopment2017Lookbook_01.LP.html?mkt_tok=eyJpIjoiWlRZNVpqSXpNa...​

So three different behaviors, where I'd expect them to all be the same collapsed form, having recognized the user.

[SanfordWhiteman]

You're missing a detail here. This form, on your Marketo LP, is not an example of Known Visitor HTML or a "partially collapsed form":

This a form with some fields PreFilled.

The reason that KV HTML doesn't take over here -- again, this is an all-Marketo setup, not your embedded form -- is that the lead doesn't have a First Name.

For bizarre reasons, the Known Visitor lookup considers a lead with an empty First Name, Last Name, or Email Address to be effectively unknown.

If you filled in the First Name with "[not provided]" as you did with the Last Name, it would work.