Choose exactly which websites can run your chatbot

Shipped

January 22, 2026

Area

Security

Available on

Every plan

Your chatbot's embed code is visible to anyone who views your page source. Without a check, someone could copy it onto their own site and run your chatbot there, spending your responses. That's why the website chat only loads on domains you've allowed. This update makes the allowlist smarter about subdomains and makes it much harder to miss when you set up a new chatbot.

What's new

Subdomain rules you can predict. When you add a domain under Allowed Domains, it now follows three simple rules:

• A base domain covers its subdomains. Adding example.com allows example.com, www.example.com, shop.example.com and any other subdomain.
• www is the same as the base domain. Adding www.example.com has the same effect as adding example.com.
• A specific subdomain allows only itself. Adding app.example.com allows that exact site and nothing else on example.com.

Country domains such as example.co.uk or example.com.au are recognised correctly, so example.co.uk covers its own subdomains without opening up the whole .co.uk space.

Reminders where you need them. When you copy your chatbot's embed code or share a preview, Studio now shows which domains your chatbot will work on. If you haven't added any yet, you'll see a clear warning: your chatbot won't work on any website until you add one. Owners and Admins get a link straight to the settings; other team members are told to ask an admin.

How to use it

1. Open the user menu and choose Organization Settings.
2. Open Domains.
3. Type your domain (for example example.com) and click Add Domain.
4. Load the page where you embedded the chatbot and check that the chat button appears.

Good to know

• Owners and Admins manage the list. Members can see the reminder but can't add or remove domains.
• One list for your whole organization. The allowed domains apply to every chatbot in your organization.
• Website chat only. The allowlist controls where the website chat widget can load. WhatsApp, Instagram DM and Facebook Messenger conversations aren't affected.
• Changes apply within minutes. Adding or removing a domain takes effect almost straight away, with no need to republish your chatbot.
• Testing on a staging site? Add the staging subdomain too, or add your base domain to cover every subdomain at once.

For more on how we protect your account and your visitors, see Security.

For developers

The check runs on the Hyperleap API, not in the browser. Requests from the website widget carry the page's Origin, and the API only answers widget requests whose origin host matches an allowed domain under the rules above. Requests from other origins are refused, so removing the embed check from a copied page doesn't help. Base domains are worked out against a list of common multi-part country suffixes (co.uk, com.au, co.jp and others).