diff --git a/datasette/templates/allow_debug.html b/datasette/templates/allow_debug.html
index 0418153182..610417d25a 100644
--- a/datasette/templates/allow_debug.html
+++ b/datasette/templates/allow_debug.html
@@ -35,7 +35,7 @@ <h1>Debug allow rules</h1>
 
 <p>Use this tool to try out different actor and allow combinations. See <a href="https://docs.datasette.io/en/stable/authentication.html#defining-permissions-with-allow-blocks">Defining permissions with "allow" blocks</a> for documentation.</p>
 
-<form action="{{ urls.path('-/allow-debug') }}" method="get" style="margin-bottom: 1em">
+<form class="core" action="{{ urls.path('-/allow-debug') }}" method="get" style="margin-bottom: 1em">
     <div class="two-col">
         <p><label>Allow block</label></p>
         <textarea name="allow">{{ allow_input }}</textarea>
diff --git a/datasette/templates/api_explorer.html b/datasette/templates/api_explorer.html
index 109fb1e957..dc393c203e 100644
--- a/datasette/templates/api_explorer.html
+++ b/datasette/templates/api_explorer.html
@@ -19,7 +19,7 @@ <h1>API Explorer{% if private %} 🔒{% endif %}</h1>
 </p>
 <details open style="border: 2px solid #ccc; border-bottom: none; padding: 0.5em">
   <summary style="cursor: pointer;">GET</summary>
-  <form method="get" id="api-explorer-get" style="margin-top: 0.7em">
+  <form class="core" method="get" id="api-explorer-get" style="margin-top: 0.7em">
     <div>
       <label for="path">API path:</label>
       <input type="text" id="path" name="path" style="width: 60%">
@@ -29,7 +29,7 @@ <h1>API Explorer{% if private %} 🔒{% endif %}</h1>
 </details>
 <details style="border: 2px solid #ccc; padding: 0.5em">
   <summary style="cursor: pointer">POST</summary>
-  <form method="post" id="api-explorer-post" style="margin-top: 0.7em">
+  <form class="core" method="post" id="api-explorer-post" style="margin-top: 0.7em">
     <div>
       <label for="path">API path:</label>
       <input type="text" id="path" name="path" style="width: 60%">
diff --git a/datasette/templates/create_token.html b/datasette/templates/create_token.html
index 2be98d38af..409fb8a93d 100644
--- a/datasette/templates/create_token.html
+++ b/datasette/templates/create_token.html
@@ -39,7 +39,7 @@ <h2>Create another token</h2>
   {% endfor %}
 {% endif %}
 
-<form action="{{ urls.path('-/create-token') }}" method="post">
+<form class="core" action="{{ urls.path('-/create-token') }}" method="post">
   <div>
     <div class="select-wrapper" style="width: unset">
       <select name="expire_type">
diff --git a/datasette/templates/database.html b/datasette/templates/database.html
index c6f3da99fc..0898559a2f 100644
--- a/datasette/templates/database.html
+++ b/datasette/templates/database.html
@@ -21,7 +21,7 @@ <h1>{{ metadata.title or database }}{% if private %} 🔒{% endif %}</h1>
 {% block description_source_license %}{% include "_description_source_license.html" %}{% endblock %}
 
 {% if allow_execute_sql %}
-    <form class="sql" action="{{ urls.database(database) }}/-/query" method="get">
+    <form class="sql core" action="{{ urls.database(database) }}/-/query" method="get">
         <h3>Custom SQL query</h3>
         <p><textarea id="sql-editor" name="sql">{% if tables %}select * from {{ tables[0].name|escape_sqlite }}{% else %}select sqlite_version(){% endif %}</textarea></p>
         <p>
diff --git a/datasette/templates/logout.html b/datasette/templates/logout.html
index 4c4a7d116e..c8fc642ab1 100644
--- a/datasette/templates/logout.html
+++ b/datasette/templates/logout.html
@@ -8,7 +8,7 @@ <h1>Log out</h1>
 
 <p>You are logged in as <strong>{{ display_actor(actor) }}</strong></p>
 
-<form action="{{ urls.logout() }}" method="post">
+<form class="core" action="{{ urls.logout() }}" method="post">
     <div>
         <input type="hidden" name="csrftoken" value="{{ csrftoken() }}">
         <input type="submit" value="Log out">
diff --git a/datasette/templates/messages_debug.html b/datasette/templates/messages_debug.html
index e0ab9a40db..2940cd6982 100644
--- a/datasette/templates/messages_debug.html
+++ b/datasette/templates/messages_debug.html
@@ -8,7 +8,7 @@ <h1>Debug messages</h1>
 
 <p>Set a message:</p>
 
-<form action="{{ urls.path('-/messages') }}" method="post">
+<form class="core" action="{{ urls.path('-/messages') }}" method="post">
     <div>
         <input type="text" name="message" style="width: 40%">
         <div class="select-wrapper">
diff --git a/datasette/templates/permissions_debug.html b/datasette/templates/permissions_debug.html
index 5a5c1aa6d3..838911812c 100644
--- a/datasette/templates/permissions_debug.html
+++ b/datasette/templates/permissions_debug.html
@@ -47,7 +47,7 @@ <h1>Permission check testing tool</h1>
 
 <p>This tool lets you simulate an actor and a permission check for that actor.</p>
 
-<form action="{{ urls.path('-/permissions') }}" id="debug-post" method="post" style="margin-bottom: 1em">
+<form class="core" action="{{ urls.path('-/permissions') }}" id="debug-post" method="post" style="margin-bottom: 1em">
     <input type="hidden" name="csrftoken" value="{{ csrftoken() }}">
     <div class="two-col">
         <p><label>Actor</label></p>
diff --git a/datasette/templates/query.html b/datasette/templates/query.html
index f7c8d0a3f7..a6e9a3aa52 100644
--- a/datasette/templates/query.html
+++ b/datasette/templates/query.html
@@ -36,7 +36,7 @@ <h1 style="padding-left: 10px; border-left: 10px solid #{{ database_color }}">{{
 
 {% block description_source_license %}{% include "_description_source_license.html" %}{% endblock %}
 
-<form class="sql" action="{{ urls.database(database) }}{% if canned_query %}/{{ canned_query }}{% endif %}" method="{% if canned_query_write %}post{% else %}get{% endif %}">
+<form class="sql core" action="{{ urls.database(database) }}{% if canned_query %}/{{ canned_query }}{% endif %}" method="{% if canned_query_write %}post{% else %}get{% endif %}">
     <h3>Custom SQL query{% if display_rows %} returning {% if truncated %}more than {% endif %}{{ "{:,}".format(display_rows|length) }} row{% if display_rows|length == 1 %}{% else %}s{% endif %}{% endif %}{% if not query_error %}
         <span class="show-hide-sql">(<a href="{{ show_hide_link }}">{{ show_hide_text }}</a>)</span>
     {% endif %}</h3>
diff --git a/datasette/templates/table.html b/datasette/templates/table.html
index 7246ff5d43..c9e0e87b7b 100644
--- a/datasette/templates/table.html
+++ b/datasette/templates/table.html
@@ -48,7 +48,7 @@ <h3>
     </h3>
 {% endif %}
 
-<form class="filters" action="{{ urls.table(database, table) }}" method="get">
+<form class="core" class="filters" action="{{ urls.table(database, table) }}" method="get">
     {% if supports_search %}
         <div class="search-row"><label for="_search">Search:</label><input id="_search" type="search" name="_search" value="{{ search }}"></div>
     {% endif %}
@@ -152,7 +152,7 @@ <h3>Advanced export</h3>
                 <a href="{{ append_querystring(renderers['json'], '_shape=object') }}">object</a>
             {% endif %}
         </p>
-        <form action="{{ url_csv_path }}" method="get">
+        <form class="core" action="{{ url_csv_path }}" method="get">
             <p>
                 CSV options:
                 <label><input type="checkbox" name="_dl"> download file</label>
diff --git a/tests/test_permissions.py b/tests/test_permissions.py
index 0e9cd15b0a..31ba104b22 100644
--- a/tests/test_permissions.py
+++ b/tests/test_permissions.py
@@ -268,7 +268,7 @@ def test_view_query(allow, expected_anon, expected_auth):
 def test_execute_sql(config):
     schema_re = re.compile("const schema = ({.*?});", re.DOTALL)
     with make_app_client(config=config) as client:
-        form_fragment = '<form class="sql" action="/fixtures/-/query"'
+        form_fragment = '<form class="sql core" action="/fixtures/-/query"'
 
         # Anonymous users - should not display the form:
         anon_html = client.get("/fixtures").text