Available on: All plans
One way to improve the security of your form is to only allow submissions from forms hosted on an authorized domain. To accomplish this, go to your form's settings and find `Restrict to Domain`. Enter your domain without a protocol.
Once saved, only submissions originating from forms on that domain, or any subdomain, will be permitted. Any submissions from unauthorized domains will fail with the following error message.
Restricting to subdomains, including www
If you enter a domain into `Restrict to Domain` without a subdomain, it will automatically match any subdomain. However, if you supply a subdomain, only submissions from that subdomain will be permitted. For example, if you enter `blog.my-website.com`, only forms on pages under the `blog` subdomain will be allowed to submit.
This is also true for the `www` subdomain. Adding the `www` prefix in settings will only permit forms to submit from the `www` subdomain. However, some websites can be reached with or without the `www` prefix. If your website is accessible through both the bare domain, and the `www` subdomain, you should leave off the `www` subdomain in the `Restrict to Domain` settings.
Caveat concerning browser support
The Restrict to Domain feature relies on the "referer" header to identify the page from which the form was submitted. The Brave browser may block the "referer" header. This issue has been filed with the Brave team. We'd love your help bringing this to the Brave team's attention by upvoting it.