Domain restrictions

A public form endpoint can be copied. Domain restrictions help make sure browser submissions come from websites you expect.

Add your domains

Open the form's Settings, then add each allowed domain under Domain restrictions.

Use the hostname only:

example.com
www.example.com

Add preview and staging hosts separately if they need to submit too.

What Form Plume checks

Form Plume compares the request's trusted browser origin with your allowlist. A browser request from another domain is rejected.

Some server requests do not include browser origin headers. If the form must also accept server-to-server submissions, use a private form instead of relying only on domains.

Domain restrictions reduce casual endpoint reuse. They do not turn anything visible in browser code into a secret.