Restrict which sites can load your widget (domain allowlist)

Anyone who can see your widget's install snippet can copy it onto another site. The domain allowlist stops that: once an agent has one, only pages on the listed domains can load it, chat with it, or search through it. Requests from anywhere else are refused.

The list is set per agent, so restricting your website's agent has no effect on a second agent used inside a mobile app.

Add domains to an agent

1. Go to Support Agents and open the agent (Edit).
2. In Allowed domains, type a domain and press Enter or click Add.
3. Repeat for each domain, then save the agent.

Each entry appears as a chip; click the cross on a chip to remove it. An agent can hold up to 20 domains.

Entry format

Type the bare domain, for example acme.com. Anything extra is stripped when you save, so all of these are stored as acme.com:

An entry that does not reduce to a valid hostname is rejected with an error rather than saved, so a typo cannot silently lock the widget out everywhere.

How matching works

• An entry matches its exact host and every subdomain. acme.com allows acme.com, www.acme.com, and app.acme.com. There is no need for wildcards; a *. prefix is accepted but changes nothing.
• To allow only a specific subdomain, list that subdomain: docs.acme.com allows docs.acme.com and anything below it, but not acme.com or www.acme.com.
• Matching is case-insensitive and ignores the page's port and protocol.
• The check is made against the browser's Origin header (falling back to the Referer). While a list is configured, a request with neither header, such as curl or a server script, is refused.
• Your hosted help center and the HelpBento admin are always allowed, so a restriction can never lock the product out of its own agent. A help center served on your own custom domain is not covered by this exception; add that domain to the list.

Localhost and mobile apps

There is no localhost exception. To test a restricted agent on your machine, add your development host (for example localhost) to the list, and remove it when you are done.

Leave the list empty for an agent used inside a mobile app. App webviews send no usable browser origin, so any configured list blocks them. The form reminds you of this while the list is empty.

Related articles

• Set up the AI chat widget
• Troubleshoot: the widget isn't appearing
• Control what your agent answers