Allowed domains
Stop other sites from loading your guidance with your publishable key.
Your publishable key is in your page source, so anyone can copy it. Allowed domains decide which sites it works on.
- Empty list (the default): guidance loads on any site.
- Once you add a domain, guidance only loads on the domains in the list. Requests from any other site are refused with
403 origin_not_allowed.
Add domains in Settings → Install → Allowed domains. Only admins and the owner can change them.
| Entry | Allows |
|---|---|
app.example.com | app.example.com only |
*.example.com | example.com and every subdomain, like app.example.com |
Entries are hostnames: no https://, path or port. A leading www. is dropped. Patterns that match everything (*) or a whole top-level domain (*.com) aren't allowed.
Add your staging and preview hosts too, or the snippet stops working there.