# Lead Capture — Website Forms & Embeds

**Document Version:** 1.0.0 (Phase 11)

---

## 1. Overview

Website Forms allow workspaces to configure public enquiry forms that can be hosted directly on LeadPilot or embedded into external websites via a single-line JavaScript snippet.

---

## 2. Form Configuration

Stored in `lead_capture_forms`:

- `name`: Internal descriptive name
- `token`: Unique secure token string (32 characters)
- `fields`: List of active fields (`first_name`, `last_name`, `email`, `phone`, `company`, `inquiry_text`, `deal_value`)
- `required_fields`: Required fields (default: `first_name`, `inquiry_text`)
- `success_message`: Custom response message
- `redirect_url`: Optional redirect URL after submission
- `follow_up_sequence_id`: Sequence to automatically enroll submissions into
- `is_active`: Toggle enabled/disabled state

---

## 3. Public Endpoints

### Hosted Form
```http
GET /capture/forms/{token}
```
Renders a clean, mobile-responsive hosted form.

### Submission Endpoint
```http
POST /capture/forms/{token}
```
Accepts form submissions (HTML form POST or JSON AJAX).

### JavaScript Embed Script
```http
GET /capture/forms/{token}/embed.js
```
External websites include this snippet:

```html
<div id="leadpilot-embed-TOKEN"></div>
<script src="https://your-leadpilot-domain.com/capture/forms/TOKEN/embed.js" async></script>
```

---

## 4. Abuse & Spam Protection

1. **Honeypot:** Hidden fields (`_hp_company`, `_hp_check`) reject automated bot submissions.
2. **Submission Timing:** Validates submission did not occur in under 1 second.
3. **Payload Capping:** Inquiries capped at 10,000 characters; disallows raw `<script>` tags.
4. **Rate Limiting:** Maximum 15 submissions per minute per IP address.