Skip to content
FormclickDocs
formclick.io Dashboard
HTML FormsSpam & security

Restrict to domain

Only accept submissions sent from your own websites. Submissions from anywhere else are rejected.

Starter, Pro and Business plans
Domain restriction is available on every paid plan.

Your access key is public, so anyone could copy your form onto another website. A domain allow-list makes Formclick accept submissions only when they come from pages on your own domains.

Set it up

  1. Open your form → Settings → Security.
  2. Under Restrict to domains, type a domain such as example.com and press Enter. Add up to 20.
  3. Add localhost as well if you test the form on your computer.
  4. Save. Leave the list empty to accept submissions from any website again.

How domains are matched

AllowedAcceptedRejected
example.comexample.com, www.example.com, shop.example.comexample.org, myexample.com, example.com.evil.net
app.example.comapp.example.com, eu.app.example.comexample.com, www.example.com

Paste a full URL if you like; https://www.example.com/contact is saved as example.com. Each domain includes all its subdomains.

What gets checked

Browsers tell Formclick which page a form was sent from (the Origin header, or Referer). If it isn’t one of your domains, or if it’s missing, the submission is rejected with 403 “This form doesn’t accept submissions from this website.” File uploads are checked the same way.

Combine it with a captcha
Domain restriction stops other websites from using your form. Scripts and bots outside a browser can fake those headers, so pair it with reCAPTCHA or Turnstile if bots are a problem.

Things to know

  • Calls from servers, cURL or mobile apps usually send no Origin, so they are rejected while a list is set. Leave the list empty for forms used that way.
  • Browsers send the page’s Origin with every form post. The exception is a site that sets Referrer-Policy: no-referrer: the browser then hides where the form came from and submissions are rejected. Use the default policy (strict-origin-when-cross-origin) on pages with your form.
  • Pages opened as local files (file://) have no domain, so test on localhost instead.
  • The restriction applies while your plan includes it. On the Free plan the saved domains are kept but not checked.
Still need help? Contact support or email support@formclick.io.