Domain allowlist
Restrict which website origins can submit to your FormsReach form.
Why allowlist
Your api_key is public in HTML. Domain allowlisting reduces abuse from random third-party sites posting to your endpoint.
How it works
Configure allowed hosts in the form settings (dashboard). Submit requests include Origin/Referer host checks against that list (plus platform-allowed hosts for dashboard previews).
If the host is not allowed, the API returns a domain denied / required style error.
Recommendations
- In production, list every production domain (and
wwwif used) - Include preview domains you intentionally test from
- Prefer HTTPS sites