Restrict submissions to specific domains

1. 1

   Open Security settings

   Open your form and go to Settings → Security.

2. 2

   Add your domains

   Under Restrict to domains, type example.com and press Enter. Each domain includes its subdomains, so example.com also covers www.example.com and shop.example.com.

3. 3

   Add localhost for testing

   If you test the form on your computer, add localhost too.

4. 4

   Save

   From now on, submissions from any other website are rejected.

Good to know

• Leave the list empty to accept submissions from any website.
• Server-side calls (cURL, your backend, mobile apps) usually don’t say which website they come from, so they are rejected while the list is set.
• Bots outside a browser can fake where they come from. For stronger protection, add reCAPTCHA or Turnstile as well.

Full details: Restrict to domain.