Domain restriction

Limit which websites can submit your embedded form.

Overview

Domain restriction lets you list the websites allowed to submit a form. When you set an allowlist, SimplyForms checks where each submission came from and rejects any that didn't originate from one of your domains — a lightweight way to stop other sites (or scrapers copying your embed snippet) from posting to your endpoint.

Plan availability: Domain restriction is included on the Pro plan and above. See pricing for the full comparison.

Setting it up

  1. Open a form in your dashboard and switch to the Security tab.
  2. Under Allowed domains, enter one host per line. Leave it blank to allow all origins (the default).
  3. Save.

Format & matching

  • Enter bare hostnames — example.com, not https://example.com/. The scheme, port, and path are ignored; matching is case-insensitive.
  • Use a leading *. to match subdomains: *.example.com matches app.example.com but not the apex example.com (add that separately if you need it).
  • Add example.com and www.example.com separately — www is not added automatically.
example.com
www.example.com
*.example.com

Scope & behavior

  • Applies to embedded forms only. Forms you host on SimplyForms (the /f/… pages) are always accepted — they're served from our own domain.
  • When a list is set, submissions with no Origin/Referer header (for example server-to-server or curlposts) are also blocked, since they can't be verified against the allowlist.
  • An empty list means unrestricted. If a team drops below Pro, a stored list stops being enforced (it's preserved and re-activates on upgrade).

Note: this is a lightweight anti-abuse control, not a hard security boundary — the browser Origin/Referer can be forged by non-browser clients. Pair it with CAPTCHA and the honeypot for stronger spam protection.