Limit where your chat widget loads
Turn on allowed domains so your website's chat widget only loads on domains you own, and stop anyone from running your snippet on another site.
On this page
Your snippet contains your website’s ID, and anyone who views your page source can copy it. By default, the widget loads on any domain where the snippet is pasted. With allowed domains on, it only loads on the domains you list.
#Turn on allowed domains
-
Go to Settings Security Allowed domains and pick the website at the top if you have more than one.
-
Turn on Restrict widget to allowed domains.
-
Type a domain, such as
example.com, and click Add domain.You can paste a full address: Pengo removes
https://and a trailing slash for you. Repeat for every domain. -
Wait for Saved in the page header.
Changes save automatically.
To take a domain off the list, click the bin next to it.
#How matching works
- One entry, one domain.
example.comdoesn’t coverwww.example.comorshop.example.com. Add each one. - No wildcards. Entries like
*.example.comaren’t accepted. - No paths. Enter
example.com, notexample.com/shop. Every page on an allowed domain can load the widget. - An empty list blocks everywhere. With the setting on and no domains added, the widget doesn’t load on any site.
#What happens on other domains
On a domain that isn’t on the list, the chat bubble doesn’t appear, and browsers refuse to show the chat window even if someone tries to embed it directly. Your own domains aren’t affected, and neither is the widget preview in the dashboard.
Changes can take a few minutes to reach visitors, and a browser that was blocked remembers it for up to an hour. Test in a new private window after you change the list.
If the widget disappears from your own site after you turn this on, check that the exact domain in your browser’s address bar is on the list, then see verify your installation.
#Related protection
Allowed domains decide where the widget can load. They don’t prove who a visitor is. To stop anyone from chatting as one of your signed-in users, set up identity verification. For more on running Pengo on several sites, see domains and multiple websites.
Common questions
Does example.com also cover www.example.com?
No. Each entry matches one exact domain. Add example.com, www.example.com and any other subdomain the widget runs on, including staging.
Can I use a wildcard like *.example.com?
No. The list only accepts full domains such as shop.example.com, so add each subdomain on its own.
Does the dashboard preview still work when the list is on?
Yes. The widget preview in Pengo isn't affected by your allowed domains.
Was this guide helpful?
Your answer helps us improve it.
Sorry about that. or contact support, and we'll fix the guide.