Track Typeform Submissions in Google Tag Manager with this Free GTM Recipe

(function () {
  if (window.__converlyRecipeTypeform) return;
  window.__converlyRecipeTypeform = true;
  window.dataLayer = window.dataLayer || [];

  // HTTPS-only, host-anchored. Matches typeform.com and any subdomain
  // (form.typeform.com is the real iframe host).
  var ORIGIN_PATTERN = /(^|\.)typeform\.com$/;

  function fireConversion(formId, responseId) {
    window.dataLayer.push({
      event: 'typeform_form_submitted',
      form_id: formId || '',
      response_id: responseId || ''
    });
  }

  // Typeform's Embed SDK has normalized the "visitor submitted" postMessage
  // type differently across versions/embed modes (inline, popup, slider).
  // Accepting the known aliases costs nothing while protecting against an
  // SDK update.
  function looksLikeTypeformSubmit(data) {
    if (!data || typeof data !== 'object') return false;
    var t = data.type;
    if (typeof t !== 'string') return false;
    return (
      t === 'form-submit' ||
      t === 'typeform.formSubmit' ||
      t === 'typeform-form-submit' ||
      t === 'embed-auto-close-popup'
    );
  }

  function pickFormId(data) {
    return data.formId || data.form_id || data.formID ||
      (data.payload && (data.payload.formId || data.payload.form_id)) || '';
  }

  function pickResponseId(data) {
    return data.responseId || data.response_id || data.responseID ||
      (data.payload && (data.payload.responseId || data.payload.response_id)) || '';
  }

  function onMessage(event) {
    if (!event || !event.source) return;
    if (event.source === window) return;
    if (!event.origin || typeof event.origin !== 'string') return;

    // Origin check — HTTPS-only, host-anchored. Extract the host from a
    // strictly-https origin and test ORIGIN_PATTERN against it. Rejects
    // http:// origins and substring-match spoofs (e.g. typeform.com.evil.com).
    var hostMatch = /^https:\/\/([^/]+)$/.exec(event.origin);
    if (!hostMatch) return;
    if (!ORIGIN_PATTERN.test(hostMatch[1])) return;

    var data = event.data;
    // Some older embeds post a JSON-encoded string instead of an object.
    if (typeof data === 'string') {
      try { data = JSON.parse(data); } catch (e) { return; }
    }
    if (!data || typeof data !== 'object') return;
    if (!looksLikeTypeformSubmit(data)) return;

    var formId = pickFormId(data);
    var responseId = pickResponseId(data);
    if (!formId || !responseId) return;

    fireConversion(formId, responseId);
  }

  window.addEventListener('message', onMessage, false);
})();