# Domain restrictions

Domain restrictions let a Form Plume form accept browser submissions only from websites you approve, cutting down on casual endpoint reuse.

A public form endpoint can be copied. Domain restrictions help make sure browser submissions come from websites you expect.

## Add your domains

Open the form's **Settings**, then add each allowed domain under **Domain restrictions**.

Use the hostname only:

```text
example.com
www.example.com
```

Add preview and staging hosts separately if they need to submit too.

## What Form Plume checks

Form Plume compares the request's trusted browser origin with your allowlist. A browser request from another domain is rejected.

Some server requests do not include browser origin headers. If the form must also accept server-to-server submissions, use a [private form](/docs/forms/private-forms) instead of relying only on domains.

Domain restrictions reduce casual endpoint reuse. They do not turn anything visible in browser code into a secret.