Domain locking

Your endpoint is public by design — it sits in the action attribute of your page. Domain locking limits where it may be posted from, so a copy of your form on someone else’s site stops working.

List the allowed domains in the form settings. Subdomains of anything you list are accepted, so example.com also covers www.example.com and app.example.com.

What it can and cannot do

• It reads the Origin and Referer headers the browser sends, which a browser will not let a page forge.
• It does not stop a script posting from a server, where those headers are whatever the author chooses — with a list configured we reject requests that carry neither, which is the best available answer.
• It is a nuisance filter for an endpoint someone copied out of your page source, not an authentication mechanism. Treat it that way.