In short
- Up to 50 domains.List each site or use a wildcard for its subdomains.
- Blocked everywhere else.The browser refuses to show your chat on other sites.
- Checked in two places.Both the chat frame and each new visitor session are checked.
- Safe wildcards only.Wildcards that would match strangers' sites are refused.
Your agent answers from your knowledge and speaks for your brand. It should not appear on a site you do not control. With allowed domains, you list the websites where your chat may run, and OneType makes sure it runs nowhere else.
Add your domains
In your agent's Security settings, add the domains where the chat should appear. You can list up to 50, each once.
- example.com allows exactly that domain.
- *.example.com allows its subdomains, such as shop.example.com.
- To cover both, add example.com and *.example.com.
- Leave the list empty and the chat runs only in OneType's own preview.
How the block works
The chat runs inside its own secure frame. OneType tells the browser to show that frame only on your allowed domains, served over https. On top of that, every new visitor session is checked against the same list. If someone copies your script tag onto another site, the chat simply does not start there.
Wildcards that stay safe
A wildcard must sit over a domain someone actually owns. OneType refuses patterns such as *.co.uk or wildcards over shared hosting suffixes, which would let anyone who registers a site there show your chat. IP addresses are refused too, and local test addresses are not accepted for live agents.
Why this protects you
Every answer your agent gives uses your knowledge and your account. If anyone could paste your chat onto their own pages, they could show your brand in places you never approved and run conversations on your account. Allowed domains close that door. Your agent answers only where you put it, and you decide when that list changes.
Keep the list up to date
Review the list whenever your sites change. A few common moments:
- You launch a new subdomain, such as help.example.com or shop.example.com.
- You move your site to a new domain.
- You want the chat on a staging site that runs on a real domain.
- You retire a site and want the chat gone from it.
Changes to the list take effect on their own once you save them in the Security settings. You do not need to change the script tag on your pages or publish the widget again.
Test before you add any domain
You do not need a single allowed domain to try your agent. Ask your real agent questions in the preview inside OneType, and the try page shows an agent over a picture of your own homepage. Add your domains when you are ready to go live.
Part of going live
Allowed domains are one of the steps that put your chat on your site, together with making the agent active and public, publishing the widget and adding the script tag. When you go live from the setup flow, you type your site's domain once and OneType adds it to the list for you, after showing you what it will add.
More on how OneType protects your data is on the security page.