LeadProof™

Capturing web forms

How the capture script seals a certificate on your consent forms — plain forms, custom / AJAX / multi-step funnels, and co-registration (multi-partner) flows alike — and how to carry the certificate ID with the lead. For the programmatic API see the API reference; for first steps see Getting Started.

Install the script

Add it to your consent page (in the <head> or before </body>). Your widget token comes from Setup → Domains once your domain is verified — it's public and only mints certificates.

<script src="https://www.leadproof.ai/capture.js"
        data-token="YOUR_WIDGET_TOKEN" async></script>

That's all that's required. On submit the script seals the consent and stamps a hidden pp_cert_id field onto the form.

Works on any form — including custom, AJAX & multi-step

  • Seals on the submit-button click or a native submit — so it works even on funnels that post via JavaScript / AJAX and never fire a native submit event.
  • Only seals forms that actually carry a phone or email — your qualifying steps and non-lead forms are ignored.
  • No captcha of your own is required. The script injects its own invisible bot challenge off-screen — nothing shows to the consumer and there's no layout impact. If you already run reCAPTCHA/hCaptcha/Turnstile and want us to use it instead, add your provider's secret under Setup → Domains (bring-your-own captcha); we'll then verify your challenge and skip injecting ours. If a domain's own captcha ever stops producing a token, we automatically fall back to our invisible challenge so certificates keep issuing.
  • Never blocks your form. No preventDefault, no resubmit; it fails open, so a capture hiccup never stops a submission.

Disclosure documents are captured automatically

We automatically archive every real <a href> disclosure link inside your form — your Terms, Privacy Policy, SMS/consent notice, and so on — branded or plain, no tagging needed — and monitor them for drift over time. If your form already links these documents, there's nothing to do.

You only need to act when a disclosure is referenced as plain text — we can't capture text, only links. Turn the reference into a real link, kept inside the sealed scope (your <form>, or your data-consent block):

<!-- consent language with REAL inline links (captured + drift-monitored) -->
By submitting, you agree to the
<a href="/terms.php" data-leadproof-doc="terms">Terms and Conditions</a> and
<a href="/privacy.php" data-leadproof-doc="privacy">Privacy Policy</a>.
  • Any real <a href> inside the sealed scope is captured — in the consent sentence or a nearby block within the same form; styling/branding doesn't matter.
  • Call the links anything you like. The visible link text is recorded exactly as the consumer saw it (“Terms”, “Terms of Use”, “Legal” — your choice), and data-leadproof-doc is an optional label you can set to any descriptor (terms, privacy, sms-consent, …) to name the document on the certificate. The link itself is what gets archived.
  • Links that only open a modal or point to # aren't documents — point to the real page (an actual URL) so it can be fetched and hashed.

Carry the certificate ID with the lead

Optional but recommended. This puts the LeadProof certificate ID into your lead payload so your buyer's system receives it — the direct analog of reading TrustedForm's cert URL. (Without it, a buyer can still Check the lead by phone/email against the certificate.)

1. Add a hidden field to the form that collects the phone/email:

<!-- on the form that collects the phone / email -->
<input type="hidden" name="pp_cert_id">

2. In most cases there's nothing more to do: the script seals as the consumer completes the form, so pp_cert_id is already filled by the time they submit, and your normal serialization carries it. You only need to await it if you redirect the instant the button is clicked (see the golden rules below), in which case wrap your post so the capture finishes first:

// Seal consent, then include the cert id with the lead (analogous to reading
// TrustedForm's xxTrustedFormCertUrl). Never blocks or resubmits your form.
window.LeadProof.capture(document.getElementById('your-form')).then(function (res) {
  var ppCertId = res && res.cert_id;        // e.g. "pp_5251e013-…"
  // The hidden pp_cert_id field is now filled — your form serialization carries it,
  // or add ppCertId to your payload object, then run your normal submit / AJAX post.
});

Co-registration — one certificate per partner

A co-reg flow shows the consumer several partner offers in sequence (one survey, then Partner A, B, C…). Instead of one blanket opt-in, LeadProof seals one certificate per partner — each with that partner's own consent language, its own linked disclosures, the shared hashed consumer identity, and a flow_id + step so the chain is reconstructable while each cert stands alone (Partner C verifies theirs without seeing A or B).

Mark up each partner offer with data-lp-partner (its name), the consent block with data-lp-consent, and its opt-in control with data-lp-affirm:

<!-- one block per partner offer -->
<div data-lp-partner="Acme Insurance" data-lp-step="1">
  <div data-lp-consent>
    Acme Insurance may call & text you about quotes. See their
    <a href="https://acme.example/privacy" data-leadproof-doc="privacy">Privacy Policy</a>.
  </div>
  <label><input type="checkbox" data-lp-affirm> I agree</label>
  <!-- the partner's cert id is stamped here on capture: -->
  <input type="hidden" name="pp_cert_id">
</div>

<div data-lp-partner="Beta Home Services" data-lp-step="2"> … </div>
  • Fires automatically when the form containing the partner blocks is submitted. For a JS funnel with no native form submit, call window.LeadProof.captureCoreg() once when the consumer finishes (optionally pass a selector/element that wraps the blocks).
  • Each block's own consent language and its <a href> disclosures are sealed into that partner's cert; the checkbox state is captured (so a pre-checked box is recorded as evidence, not hidden).
  • Each partner's cert id is stamped back into its block — into a hidden pp_cert_id field there, or a field you name with data-lp-cert-field — so the right id rides with each partner's lead. The full result also fires as pp:captured-coreg on document: document.addEventListener('pp:captured-coreg', e => e.detail.certs).
  • One shared bot challenge covers the whole flow; each partner cert clears its own Check/Claim and routes only to the buyer that partner disclosed.

Golden rules for your submit handler

  • You usually don't need to change your submit code. pp_cert_id fills in automatically as the consumer completes the form.
  • If you redirect immediately on submit (e.g. window.location = '/request.php?…'), do the redirect inside window.LeadProof.capture(form).then(…), or listen for the pp:captured event — otherwise you can navigate away before the id is attached.
  • Never put the consumer's phone, email, name, or address in a redirect URL. Post them in the request body instead — query-string values land in server logs, browser history, and the Referer sent to every third party on the destination page.
  • If your consent block isn't the whole form, add data-consent="#your-consent-wrapper"so the right language is sealed.

Privacy: the script never sends field values or the page's query string to LeadProof — the sealed page URL is reduced to its origin and path, so consumer data prefilled into a URL is never recorded on the certificate.

Reference

  • Hidden field — <input name="pp_cert_id"> is filled with the cert id (a field you pre-add, or one the script appends).
  • API — window.LeadProof.capture(formOrSelector) returns a promise resolving to the result (cert_id, trust_score, trust_tier) or null.
  • Event — pp:captured is dispatched on the form: form.addEventListener('pp:captured', e => e.detail.cert_id).
  • Scope — by default the whole <form> is sealed; add data-consent="#selector"to seal a specific block (it must contain both the consent language and the submit button).

What's sealed: the exact consent language shown, the disclosures it links to (fetched + hashed), behavioral/anti-fraud signals, a one-way hash of the phone/email (plaintext discarded), and an RFC-3161 trusted timestamp.

LeadOpera™ is a trademark of LeadOpera LLC, a Colorado limited liability company. Its products and services — including LeadProof™ and TermsProof™ — are proprietary and operated through their independent websites; LeadProof™ and TermsProof™ are trademarks of LeadOpera LLC. Unauthorized use of these marks is strictly prohibited. The certification method used by LeadOpera’s products is patent pending. A certificate is a tamper-evident technical record — not a determination of legal or regulatory compliance, validity, or enforceability, and not legal advice.

TrustedForm, Jornaya, Boberdoo, Phonexa, LeadsPedia, Google, Meta, Facebook, Instagram, Twilio, DigiCert, and Sectigo are trademarks of their respective owners; their mention describes interoperability only and does not imply any affiliation with, endorsement by, or sponsorship from those companies.

Press, partnership, and general inquiries: inquiry@leadopera.com

© 2026 LeadOpera LLC. All rights reserved.