Limits and reference

Don't do this

These look like improvements and are not — they either break the security model or cut the customer off from fixes we ship.

• Do not copy embed.js onto your own server. It is served from us precisely so bug fixes reach customers without anyone editing HTML.
• Do not build your own form against our API. The endpoint is protected by spam control, an origin allowlist and rate limiting, and the contract is internal and can change without notice.
• Do not set a fixed height on the iframe or .kapture-signals-embed — it disables the auto-height and cuts the form off.
• Do not wrap the script tag in another iframe. The form is already an iframe, and the extra layer breaks height syncing.
• Do not remove async, and do not defer the script with your own lazy loader without testing the whole flow afterwards.
• Do not edit the iframe's src or query parameters by hand.

Under the hood

For orientation only. None of this has to be configured on the host site — it is described so you recognise what you see in DevTools.

• The script inserts a <div class="kapture-signals-embed"> containing an <iframe> pointing at https://kapturesignals.com/f/<slug>?embed=1&po=<host origin>.
• Height is synced with a postMessage of type "kapture:resize", clamped to 120–20000 px, so a bug can never produce an extreme frame in the middle of the page.
• Both sides validate origin before reading a message: the host page only accepts messages from the origin the script itself was loaded from and from precisely its own iframe, and the iframe only posts to an origin we have checked server-side against the contractor's list — never to "*".
• The script is dependency-free ES5, so it runs in whatever a contractor's website was built in, and it sets no cookies on the host domain.
• The form runs Cloudflare Turnstile for spam control inside the iframe. Nothing needs to be added on the host site for it — and nothing needs to be set up in Cloudflare for your domain.

Help

The slug and the list of domains are in the contractor's own account. Anything else that needs a change on our side: contact Kapture Signals through the contractor or the contact person who gave you the job.

The form itself is in Danish — the product currently serves Danish contractors and their customers.