Allowed origins
Limit which browser origins may submit to a public form.
Use exact HTTPS origins
An origin contains scheme, hostname, and optional port, without a path. List the production site and only the development or preview origins you intentionally support.
Verify in the browser
Test the deployed page because file://, localhost ports, preview hostnames, and www aliases are different origins. Inspect the blocked response rather than guessing from the UI.
Treat origin policy as one layer
Non-browser clients can forge headers. Schema validation, rate limits, spam controls, and monitoring remain necessary.
Documentation reviewed on October 20, 2026Suggest an improvement →