Domain Whitelisting

What is Domain Whitelisting?

Domain whitelisting controls which websites can submit data to your forms. Only submissions from whitelisted domains are accepted, helping prevent unauthorized access and spam.

Wildcards

Accept all domains: To accept form submissions from any website, add the wildcard * to your whitelist. Every new team automatically gets a * domain for convenience.

Wildcard subdomains: You can use wildcard patterns for subdomains, such as *.example.com to allow all subdomains of example.com (e.g., app.example.com, api.example.com, dev.example.com).

Adding a Domain

1. Click Add New Domain
2. Enter the domain name (e.g., example.com)
3. Click Save

Accepted formats:

• Domain names: example.com, www.example.com, subdomain.example.com
• Wildcard subdomains: *.example.com
• Development: localhost
• Global wildcard: *

Not accepted:

• Paths are not allowed (e.g., example.com/contact)
• Enter only the domain name

The system automatically normalizes your input by removing protocols, ports, and converting to lowercase.

All domains are converted to lowercase for consistency.

Viewing Your Domains

The Domains page shows all whitelisted domains for your current team. These domains apply to all forms in your team.

Note: www.example.com and example.com are treated as different domains. Add both if needed.

Deleting a Domain

1. Click the Delete button (trash icon) next to the domain
2. Confirm the deletion

Warning: Deleting a domain immediately blocks submissions from that domain.

Common Uses

Allow all domains (public forms):

• Add * to your whitelist

Allow all subdomains:

• Add *.example.com to allow app.example.com, api.example.com, etc.

Allow specific websites:

• Add each domain separately (e.g., mywebsite.com, myapp.com)

Development/Testing:

• Add localhost or keep the * wildcard