What a SayPage page can contain

You never have to write any of this yourself: your assistant reads SayPage's page guide before it writes a page, and SayPage tells it exactly what to fix when something is off. This page is for the curious, and for knowing what to ask for.

One page, one HTML document#

A SayPage page is a single, self-contained HTML document: its styles and scripts are written inside it, its images are uploaded to SayPage, and it loads nothing from other sites except the embeds and libraries listed below. It is a page, not an app: no build step, no server code, no database.

This is what lets SayPage check every page before it goes online, serve it fast, and keep visitors safe.

What a page can do#

• Animations: entrances, scroll reveals, tap feedback, animated gradients, marquees, counters, confetti, Lottie illustrations.
• Interactive bits: tabs, accordions, filters, ingredient checklists, timers, countdowns, carousels, charts, a search box over the page's own content.
• Embeds: videos, music, bookings, forms, maps and posts from the services below.
• Your images: up to 30 photos per page, uploaded to SayPage.
• One custom font, inlined in the page, from a font file whose license allows it (for example the SIL Open Font License of most Google Fonts). Otherwise, system fonts.
• Links anywhere: https: and http: addresses, mailto:, tel: and sms:. Affiliate links are fine.

Embeds#

Embeds are iframes from these services:

A page has no <form> of its own: to collect sign-ups or orders, link to a form on Tally, Typeform or Google Forms, or embed a Typeform. Videos and music are embedded from the services above rather than uploaded.

Libraries#

Pages may load these open source libraries, served by SayPage at pinned versions (your assistant gets their exact addresses from the list_libraries tool):

What SayPage refuses#

Some things are refused because they could harm visitors or because SayPage could not check them:

• Forms and sensitive fields: <form>, password fields and card-number fields.
• Network access from scripts: pages cannot call other servers, so a page cannot quietly send visitors' data anywhere.
• Tracking and storage: no cookies, localStorage or other browser storage, and no analytics scripts. SayPage counts visits itself, without cookies.
• Redirects and pop-ups: scripts cannot send visitors elsewhere, open windows or change where a link goes. Every link is written in the page with its final address.
• Link shorteners (bit.ly, tinyurl, t.co…): links must show where they really go.
• Hidden or encoded code: scripts must be readable (no minified or encoded code, at most 100 KB of JavaScript), and pages carry no embedded files.
• External images, scripts and fonts, other than the embeds and libraries above.
• Advertising (ad networks) and crypto wallet addresses.
• Hiding the SayPage badge or stopping its links from working.

And, whatever the code: phishing, impersonation of a brand or organization, scams, sexual, hateful, violent or dangerous content, and anything illegal. See Privacy and safety.

Size limits#

How pages are served#

Every page is served on your site's address, over HTTPS, with a strict security policy written for that page: it can only load what it was published with. Pages are cached for a short time, so a new version shows up within about a minute of publishing.

Next#

• Images and uploads
• Create, preview and publish pages