> They are stripping all JS Are they now? Add a `visibility: hidden` to random elements on the page, and show them with javascript. OR Are they removing _al

> They are stripping all JS Are they now? Add a `visibility: hidden` to random elements on the page, and show them with javascript. OR Are they removing _all_ js? Have you checked whether they remove `<body onclick="some javascript code that injects some other code">` ? You can try to do script injection _into your own site_ to see if their mirroring software is smart enough to deal with all the different xss vectors. Bonus points: if they remove your <body onhover=>` attribute, add a style like body { display: none} body[onhover='the js code that they will remove'] {display: block}