In general, Buttondown does not allow you to embed custom scripts via script tags or other methods into the header, footer, or body of your emails or archives. If you really need that kind of rich interactivity, you might want to look into using us in headless mode and rolling your own site instead. However, we make exceptions and keep an allow list for specific snippets that make sense and have been approved by our security auditing. These scripts are as follows:
| Script | URL |
|---|---|
| AddToAny | https://static.addtoany.com/menu/page.js |
| Bluesky embed | https://embed.bsky.app/static/embed.js |
| https://connect.facebook.net/en_US/sdk.js | |
| Flickr embed | https://embedr.flickr.com/assets/client-code.js |
| Fathom | https://cdn.usefathom.com/script.js |
| https://www.instagram.com/embed.js | |
| Plausible | https://plausible.io/js/script.js |
| Simple Analytics | https://scripts.simpleanalyticscdn.com/latest.js |
| Sniperlink | https://sniperl.ink/v1/sniper-link.js |
| TikTok embed | https://www.tiktok.com/embed.js |
| Twitter embed | https://platform.twitter.com/widgets.js |
| Umami | https://cloud.umami.is/script.js |
If you feel that a script should be added to the allow list, please contact support and we'll be happy to review it.