You need a Squarespace plan with Code Injection: Core, Plus, Advanced, Business or Commerce. Squarespace doesn't offer it on its entry-level plans.
1. Copy your snippet
Sign in at app.pengon.dev and open Setup. Your snippet is one line, already filled in with your site's ID. Click Copy.
2. Paste it into Squarespace
- In Squarespace, click Website to open the Pages panel.
- Scroll to the bottom and click Custom Code, then Code Injection. On a version 7.0 site, it's under Website Tools instead.
- Paste the snippet into the Header box, not the Footer, and click Save.
It has to be the Header: the snippet must load before Squarespace's form code to catch spam.
3. Open your live site
Open a page with your form on your published website, at your real address like www.yoursite.com. Within about 10 seconds, the Setup page shows Connected. To see a first message in your dashboard, send a test through the form.
Two places where it won't work, and where most people test by accident:
- The Squarespace editor preview: forms are switched off there.
- Your xxxx-yyyy.squarespace.com address: it isn't your real site, so the test doesn't count.
That's it
Pengon now checks every form submission on your site. Spam is stopped before it reaches you, and everything else arrives as usual. Your visitors see the same form and the same thank-you message.