Domain locking

An access key is public by design — it sits in the HTML of your page. Domain locking limits where it may be used from, so a copy of your form on someone else’s site stops working.

List the allowed domains in the form settings. Subdomains of anything you list are accepted, so example.com also covers www.example.com and app.example.com.

What it can and cannot do

• It reads the Origin and Referer headers the browser sends, which a browser will not let a page forge.
• It does not stop a script posting from a server, where those headers are whatever the author chooses — with a list configured we reject requests that carry neither, which is the best available answer.
• It is a nuisance filter for stolen keys, not an authentication mechanism. Treat it that way.