# Domain allowlist

Restrict which website origins can submit to your FormsReach form.

## Why allowlist

Your `api_key` is public in HTML. Domain allowlisting reduces abuse from random third-party sites posting to your endpoint.

## How it works

Configure allowed hosts in the form settings (dashboard). Submit requests include Origin/Referer host checks against that list (plus platform-allowed hosts for dashboard previews).

If the host is not allowed, the API returns a domain denied / required style error.

## Recommendations

- In production, list every production domain (and `www` if used)
- Include preview domains you intentionally test from
- Prefer HTTPS sites

## Related

- [Spam protection](/docs/submit-api/spam/)
- [Troubleshooting](/docs/help/troubleshooting/)