Take proposal requests on your own website.

A visitor fills in their name, how to reach them, and what their community needs. You get the request in your dashboard under Settings, Website plugin, and you reply to them directly with a proposal. It is part of every account, there is no charge per request, and there is no limit on how many pages you put it on.

• Room for a key

  Fewer than 10 live keys of your own on your company. That is the only ceiling on getting a new one. Revoke a key you are not using and the room reopens.

• An admin login

  Your company’s admin login for VendoRFP. A technician login can read the requests that arrive but cannot decide which websites carry the form.

• A place to paste HTML

  The ability to add a block of HTML to a page on your site. Every platform below has one, and the instructions say where it is.

1. 1

   Open the plugin page in your dashboard

   Sign in and go to Settings, then Website plugin.

2. 2

   Type the web address your site lives at

   Type it exactly as it appears in the browser bar, for example acme-lawns.com. To a browser, acme-lawns.com and www.acme-lawns.com are two different addresses, so adding one offers you the other. Add both if your site answers on both. You can register up to 10 addresses on one key, which is room for a live site, a staging site and a couple of landing pages.

3. 3

   Press the button and copy the key

   You get a key that starts with vrfp_embed_. It is meant to be public and goes into your page’s HTML where anyone can read it. What stops somebody else using it is the list of addresses you just registered. A browser refuses to show your form on any site that is not on it.

<div data-vendorfp-proposal-form data-key="vrfp_embed_your_key_here"><a href="https://hoacrew.com/embed/w/vrfp_embed_your_key_here">Request a proposal</a></div>
<script src="https://hoacrew.com/embed/v1.js" async></script>

https://hoacrew.com/embed/w/vrfp_embed_your_key_here

<div data-vendorfp-proposal-form data-key="vrfp_embed_your_key_here"><a href="https://hoacrew.com/embed/w/vrfp_embed_your_key_here">Request a proposal</a></div>
<script src="https://hoacrew.com/embed/v1.js" async></script>

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Contact | Acme Lawns</title>
  </head>
  <body>
    <h1>Ask us for a proposal</h1>
    <p>Tell us about your community and we will put a proposal together.</p>
    <div data-vendorfp-proposal-form data-key="vrfp_embed_your_key_here"><a href="https://hoacrew.com/embed/w/vrfp_embed_your_key_here">Request a proposal</a></div>
    <script src="https://hoacrew.com/embed/v1.js" async></script>
  </body>
</html>

if (window.VendoRFPEmbed) window.VendoRFPEmbed.mount();

<meta http-equiv="Content-Security-Policy"
      content="script-src 'self' https://hoacrew.com; frame-src https://hoacrew.com">

'use client';
import { useEffect, useRef } from 'react';

export function ProposalRequestForm() {
  const mounted = useRef(false);
  useEffect(() => {
    if (mounted.current) return;
    mounted.current = true;
    const s = document.createElement('script');
    s.src = 'https://hoacrew.com/embed/v1.js';
    s.async = true;
    document.body.appendChild(s);
  }, []);
  return (
    <>
      <div
        data-vendorfp-proposal-form
        data-key="vrfp_embed_your_key_here"
      >
        {/* Plain HTML, so it is there if the loader is blocked or scripting
            is off. The loader empties this div before it inserts the form. */}
        <a href="https://hoacrew.com/embed/w/vrfp_embed_your_key_here">Request a proposal</a>
      </div>
    </>
  );
}

'use client';
import Script from 'next/script';

export function ProposalRequestForm() {
  return (
    <>
      <div data-vendorfp-proposal-form data-key="vrfp_embed_your_key_here">
        {/* Plain HTML, so it is there if the loader is blocked. */}
        <a href="https://hoacrew.com/embed/w/vrfp_embed_your_key_here">Request a proposal</a>
      </div>
      <Script src="https://hoacrew.com/embed/v1.js" strategy="afterInteractive" />
    </>
  );
}

'use client';
import { useEffect } from 'react';
import { usePathname } from 'next/navigation';

export function ProposalRequestMount() {
  const pathname = usePathname();
  useEffect(() => {
    window.VendoRFPEmbed?.mount();
  }, [pathname]);
  return null;
}

// types/vendorfp.d.ts, or anywhere in your project's type scope
declare global {
  interface Window {
    VendoRFPEmbed?: { mount: () => void; version: number };
    gtag?: (...args: unknown[]) => void;
  }
}
export {};

'use client';
import { useEffect } from 'react';

export function ProposalRequestTracking() {
  useEffect(() => {
    function onSent() {
      window.gtag?.('event', 'generate_lead');
    }
    document.addEventListener('vendorfp:proposal-request-sent', onSent);
    return () => document.removeEventListener('vendorfp:proposal-request-sent', onSent);
  }, []);
  return null;
}

// next.config.mjs
async headers() {
  return [
    {
      source: '/:path*',
      headers: [
        {
          key: 'Content-Security-Policy',
          value: "script-src 'self' https://hoacrew.com; frame-src https://hoacrew.com",
        },
      ],
    },
  ];
}

On something else? The plain HTML tab has a complete worked example, and every platform that lets you paste a block of HTML behaves the same way.

https://acme-lawns.com
https://www.acme-lawns.com
http://acme-lawns.com
http://www.acme-lawns.com

A browser treats these as four different places. Most sites answer on two of them and redirect the other two. Whichever ones a visitor can end up on need to be on your list. Adding one on the plugin page offers you its companion for exactly this reason. Take the offer.

• A staging or preview address

  Webflow sites also answer at webflow.io, Shopify stores at myshopify.com, Squarespace trials at squarespace.com. Testing there means registering there.

• A second domain

  A company that owns both a .com and a .net, or a separate landing page domain, needs each one listed.

• A page opened from your desktop

  A file opened directly rather than served by a web server has no address for us to check against anything, so the form will not appear. Put the page on a server, even a local one, and register the address it answers on.

If yours has one, because a security plugin added it, your host sets it, or whoever built the site wrote one, it needs to allow two things from us.

script-src  https://hoacrew.com
frame-src   https://hoacrew.com

The first lets the loader script run. The second lets the form’s frame render. Allow the first and forget the second and you get a blank space where the form should be, with a line in the browser’s Console tab naming frame-src. Nothing else is needed. The form loads no fonts, no analytics and no other company’s code, so there is no third allowance hiding behind these two.

1. 1

   Open the live page in a normal tab

   Use the real site, not the editor and not a builder preview.

2. 2

   Send yourself a test

   The form is there with your company’s name on it. Take more than 4 seconds over it, because a submission completed unusually fast is placed under suspected spam.

3. 3

   Look in your dashboard

   Open Settings, then Website plugin. Your test is in the list.

Put it behind a button, in an email signature, on a Google Business profile, or on a page you cannot add code to. It needs no plan, no code block and no addresses registered, because the list of allowed addresses governs where the form may be shown inside another page, and a link opens it as its own.

https://hoacrew.com/embed/w/vrfp_embed_your_key_here

Requests from it arrive in your dashboard exactly like the ones from the embedded version. It is also what a visitor is shown automatically if the embedded form cannot load for any reason, so nobody is ever left looking at a blank space.

It is a bubbling vendorfp:proposal-request-sent event. It carries no visitor data at all, not a name and not an email, just the fact that a request went through, so adding a conversion tag never turns your tag manager into a holder of somebody else’s contact details.

document.addEventListener('vendorfp:proposal-request-sent', function () {
  // your own conversion tracking here
  if (window.gtag) window.gtag('event', 'generate_lead');
});

In React or Next.js the same listener goes in an effect. The React tab has it written out with the cleanup.

• Your key is public, and that is fine

  It ships in your page’s HTML, and it can do exactly one thing: create a proposal request for your company. It reads nothing back.

• Only your addresses can display it

  Every time the form loads, we tell the browser which addresses may show it, and the browser enforces that. A site that is not on your list never receives the form. Its visitors get a button to your hosted form instead, and anything they send from it still arrives addressed to you.

• The form is not in your page

  It sits in a frame on our side of a boundary the browser enforces, so the other scripts on your page cannot read what a visitor types. Analytics, chat and a plugin from 2019 alike. Our frame cannot read your page either.

• Automated submissions are kept

  Two checks run, and neither needs a puzzle from your visitors. Anything that trips one is recorded under Filtered as spam, where one press moves it back. A real customer is worth more than a clean inbox.

• What is recorded

  What they typed, which of your addresses they were on, and the time. Their IP address is not stored. A one-way fingerprint of it is stored instead. No cookies and no tracking.

• No email is sent

  Not to you and not to the visitor. The request appears in your dashboard, which cannot bounce and needs nobody’s mail server to be working.

1. 1

   Copy the address out of your browser bar

   Open the page with the missing form and copy the whole address from the bar at the top of the browser, exactly as it appears. That includes https and includes www if it is there.

2. 2

   Open the plugin page in your dashboard

   Go to Settings, then Website plugin, and look at the list of addresses on your key.

3. 3

   Compare them character by character

   The address you copied has to be on that list, spelled the same way. Not a version of it, and not the domain it belongs to. If it is missing, add it and reload the page. The fix takes effect immediately and you do not touch your website again.

• You see a Request a proposal button instead of the form

  That is the fallback, and it is deliberate. The frame did not load, so rather than leave a hole in your page the loader puts a working button there instead. Nobody is stranded while you fix it. The cause is nearly always the address.

• Nothing appears at all, not even a button

  The button lives in the snippet itself as plain HTML, so if even that is missing the snippet is not on the page. Look at the page’s source and search it for proposal-form. If it is not there, your website builder removed the code when you saved. Some builders and some WordPress logins strip script tags. Ask whoever administers the site, or use the hosted link instead.

• The key has been turned off

  A revoked key stops working everywhere on the next request, by design. Check the plugin page. If there is no live key, issue one and repaste the snippet, because a new key is a new string.

• The key in the page is not the key on the plugin page

  A snippet pasted from an older note, or a key truncated by a builder’s text box, both look fine and both fail. Copy it again from the dashboard rather than from anywhere else.

• Your site has a security policy

  If something on your site sets a Content-Security-Policy, it has to allow our address in both its script and its frame lists. The security policy section above has the two allowances, and the browser’s Console tab names which one is missing.

• A builder that runs code inside its own frame

  Wix is the one this affects. Its embed box puts your code on a Wix address rather than yours, so the address being checked is not the one you registered. The Wix tab has the working route.

• The form is there but cut off at the bottom

  The form measures itself and asks for the height it needs, which works everywhere except inside a builder that locks its embed to a fixed height. Drag the embed box taller.

• An ad blocker or a privacy extension

  Try the page in a private window with extensions off. If it appears there, the extension is blocking the frame for you and not for your visitors. That is worth knowing before you change anything else.

A submission completed in under 4 seconds lands under Filtered as spam on the plugin page, and a test typed by somebody who already knows what every box says can complete it faster than that. That is the check doing its job, not a fault. One press moves it back, and nothing was ever discarded. A request that trips a check is still written, still yours, and still answerable.

Adding or removing an address takes effect on the next page load. You do not touch your website again. Changing the heading, the color or the preselected service means copying the snippet again, because those live in the snippet.

Turning the key off stops the form appearing anywhere, immediately. Every request it collected stays in your dashboard. Those are your customers, and burning a key never takes them with it. Issuing a new key is the only capped action: 10 live keys of its own is as many as a company holds at once, and revoking one opens a slot for another.