Agent WranglersEmail security Avoid
Send no scripts or forms in email
Do not put scripts, forms, embedded frames or plugins in email. Mail apps strip or block them, and they look like attacks.
How to do it
Use plain links to pages on your site for every action. Interactive formats such as AMP for Email need sender registration and a plain fallback, so add them only with a clear reason.
How to check
Search the HTML of every template for <script, <form, <iframe, <object and <embed. None appears, apart from <script type="application/ld+json"> for structured data.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/active-content.