Attribution tracking and redirects

The embed script can access the page that contains the iframe. The embedded form cannot access that page across origins. The script captures supported attribution signals from the parent page and sends them to the form through a versioned message protocol.

Captured attribution

If a value is absent, the script omits it instead of sending an empty string.

SourceCaptured values
Query stringfbclid, gclid, utm_source, utm_medium, utm_campaign, utm_content
Cookies_fbc, _fbp
PageLanding URL and document.referrer

When _fbc is absent but fbclid is present, the script synthesizes an _fbc value and records its timestamp. A real _fbc cookie is always used unchanged.

Siv does not create tracking cookies or make consent decisions. Only run browser advertising code after your consent platform says it is permitted.

Message security

The script posts the tracking payload to the origin in the iframe's src. It does not use the wildcard * origin. An iframe does not receive tracking data unless its source is a cross-origin http or https URL.

Redirect and submission messages are accepted only when their source window and origin match a known Siv form iframe.

Redirect behavior

If a form has a redirect URL configured, the iframe asks the parent page to navigate after the accepted-submission callback is dispatched. Only the first redirect request is honored.

Siv blocks URL schemes that can execute scripts or render inline content in the customer's origin. Blocked schemes include javascript:, data:, vbscript:, blob:, file:, and about:. Siv allows standard HTTPS URLs and explicitly configured application links, such as tel: and mailto:.

Troubleshooting

If the form does not resize or no callback arrives:

  1. Confirm the iframe has a data-siv-form-id attribute.
  2. Confirm the CDN script loads without a browser or content security policy (CSP) error.
  3. Confirm the script tag is not marked type="module".
  4. Register callback listeners before visitors can submit.
  5. Confirm a proxy or tag manager is not rewriting the iframe origin.