Allowed domains

Restrict your Boei widget to load only on the domains you list. Useful if you want to make sure your widget snippet only runs on your own site, and not somewhere it was accidentally (or deliberately) copy-pasted.

How to get there: Go to Setup → Widget in the top menu → click your widget → open the Advanced tab → scroll to Allowed domains.

How it works

  • Leave the list empty (the default): the widget loads on any domain. This is the same behavior every existing install has.
  • Add one or more domains: the widget will only load on those domains. On any other domain, nothing renders and the browser console shows Boei: this widget is restricted to specific domains and is not allowed on this site.

Enforcement is browser-side (script guard + CSP frame-ancestors on the chat iframe), so pasting either the widget snippet OR the chatbot iframe URL on an off-list site will not render.

Pattern rules

You add Matches Does NOT match
acme.com acme.com www.acme.com, shop.acme.com
*.acme.com www.acme.com, shop.acme.com, a.b.acme.com acme.com (the bare apex)
acme.com and *.acme.com acme.com and every subdomain —

Add both acme.com and *.acme.com if you want the apex and all subdomains covered.

Localhost (localhost, 127.0.0.1) and bare IPs work too, useful during development.

Notes

  • The list is per-widget, not per-account. If you have several widgets, set the list on each one you want to restrict.
  • Changes take effect for new visitors immediately, and for returning visitors within about 5 minutes (once their browser refreshes our short-lived bootstrap cache).
  • You can paste full URLs like https://acme.com/ — we strip the protocol and path automatically and store just the host.
  • Up to 100 domains per widget.