Allowed domains
Restrict your Boei widget to load only on the domains you list. Useful if you want to make sure your widget snippet only runs on your own site, and not somewhere it was accidentally (or deliberately) copy-pasted.
How to get there: Go to Widgets in the left menu → click your widget → open the Advanced tab → scroll to Allowed domains.
How it works
- Leave the list empty (the default): the widget loads on any domain. This is the same behavior every existing install has.
- Add one or more domains: the widget will only load on those domains. On any other domain, nothing renders and the browser console shows
Boei: this widget is restricted to specific domains and is not allowed on this site.
Enforcement is browser-side (script guard + CSP frame-ancestors on the chat iframe), so pasting either the widget snippet OR the chatbot iframe URL on an off-list site will not render.
Pattern rules
| You add | Matches | Does NOT match |
|---|---|---|
acme.com |
acme.com |
www.acme.com, shop.acme.com |
*.acme.com |
www.acme.com, shop.acme.com, a.b.acme.com |
acme.com (the bare apex) |
acme.com and *.acme.com |
acme.com and every subdomain |
— |
Add both acme.com and *.acme.com if you want the apex and all subdomains covered.
Localhost (localhost, 127.0.0.1) and bare IPs work too, useful during development.
Notes
- The list is per-widget, not per-account. If you have several widgets, set the list on each one you want to restrict.
- Changes take effect for new visitors immediately, and for returning visitors within about 5 minutes (once their browser refreshes our short-lived bootstrap cache).
- You can paste full URLs like
https://acme.com/— we strip the protocol and path automatically and store just the host. - Up to 100 domains per widget.