First, thanks for writing about this, great real case examples and advices David. Second, wouldn’t it be better to use postMessage to communicate the submit state (like idle, sending, success) using good ol’ JavaScript AJAX inside the iframe to send the data and avoid targeted malware that way? It doesn’t sound complicated initially.