# Restrict to domain

> Only accept submissions sent from your own websites. Submissions from anywhere else are rejected.

Source: https://docs.formclick.io/html-forms/restrict-domain

> **Starter, Pro and Business plans:** Domain restriction is available on every paid plan.

Your access key is public, so anyone could copy your form onto another website. A domain allow-list makes Formclick accept submissions only when they come from pages on your own domains.

## Set it up

1. Open your form → **Settings → Security**.
2. Under **Restrict to domains**, type a domain such as `example.com` and press Enter. Add up to 20.
3. Add `localhost` as well if you test the form on your computer.
4. Save. Leave the list empty to accept submissions from any website again.

## How domains are matched

| Allowed | Accepted | Rejected |
| --- | --- | --- |
| `example.com` | `example.com`, `www.example.com`, `shop.example.com` | `example.org`, `myexample.com`, `example.com.evil.net` |
| `app.example.com` | `app.example.com`, `eu.app.example.com` | `example.com`, `www.example.com` |

Paste a full URL if you like; `https://www.example.com/contact` is saved as `example.com`. Each domain includes all its subdomains.

## What gets checked

Browsers tell Formclick which page a form was sent from (the `Origin` header, or `Referer`). If it isn’t one of your domains, or if it’s missing, the submission is rejected with `403` “This form doesn’t accept submissions from this website.” File uploads are checked the same way.

> **Combine it with a captcha:** Domain restriction stops other websites from using your form. Scripts and bots outside a browser can fake those headers, so pair it with [reCAPTCHA](https://docs.formclick.io/html-forms/recaptcha) or [Turnstile](https://docs.formclick.io/html-forms/turnstile) if bots are a problem.

## Things to know

- Calls from servers, cURL or mobile apps usually send no `Origin`, so they are rejected while a list is set. Leave the list empty for forms used that way.
- Browsers send the page’s `Origin` with every form post. The exception is a site that sets `Referrer-Policy: no-referrer`: the browser then hides where the form came from and submissions are rejected. Use the default policy (`strict-origin-when-cross-origin`) on pages with your form.
- Pages opened as local files (`file://`) have no domain, so test on `localhost` instead.
- The restriction applies while your plan includes it. On the Free plan the saved domains are kept but not checked.