> They are stripping all JS

Are they now?

Add a `visibility: hidden` to random elements on the page, and show them with javascript.

OR

Are they removing _all_ js? Have you checked whether they remove `<body onclick="some javascript code that injects some other code">` ?

You can try to do script injection _into your own site_ to see if their mirroring software is smart enough to deal with all the different xss vectors.

Bonus points: if they remove your <body onhover=>` attribute, add a style like

body { display: none} body[onhover='the js code that they will remove'] {display: block}