---
title: "Send no scripts or forms in email · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/email-security/active-content
updated: 2026-10-20
licence: "All rights reserved"
---

# Send no scripts or forms in email

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Avoid
- Chapter: [Email security](https://agentwranglers.se/playbook/email/email-security)
- Rule: Do not put scripts, forms, embedded frames or plugins in email. Mail apps strip or block them, and they look like attacks.
- How: Use plain links to pages on your site for every action. Interactive formats such as AMP for Email need sender registration and a plain fallback, so add them only with a clear reason.
- Check: Search the HTML of every template for `<script`, `<form`, `<iframe`, `<object` and `<embed`. None appears, apart from `<script type="application/ld+json">` for structured data.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/active-content`.

- Previous: [Avoid risky attachments](https://agentwranglers.se/playbook/email/email-security/safe-attachments)
- Next: [Sign or encrypt sensitive mail](https://agentwranglers.se/playbook/email/email-security/signed-encrypted-mail)
- [Email security](https://agentwranglers.se/playbook/email/email-security)