{% comment %} Self-contained HTML for the iframe embed. No external assets and no framework: this is served onto someone else's site and must not depend on anything we would later move. Phone first, because an iframe is usually narrower than the page that holds it. The submit URL is carried on a `data-` attribute rather than interpolated into a JS string literal. Django escapes attribute values, so there is no way to break out of the quoting; building a bare `var url = "{{ submit_url }}"` would put template output inside a script block, which is where escaping bugs live. NEVER reference `form.captcha_secret` here. Only `captcha_site_key` is public. {% endcomment %} {{ form.name }}
{% for field in fields %}
{% if field.lead_field == "description" %} {% else %} {% endif %}
{% endfor %} {% if form.captcha_provider == "turnstile" %}
{% endif %}