Allowed Domains: CORS Origin Locking for Forms
Ensure only your authorized websites can post to your form endpoints
How does Form2Lead handle allowed domains: cors origin locking for forms?
Form2Lead enforces allowed domain lists per form, blocking unauthorized third-party websites or malicious origins from hijacking your API endpoints.
Capability Overview
Prevent unauthorized sites from copying your form action URL and sending fake leads. Lock down your form endpoints to specific domain names.
Key Benefits & Developer Controls
- ✔Exact domain matching (e.g. `example.com`, `app.example.com`) so each environment — staging, production, previews — is listed explicitly.
- ✔CORS header enforcement on API submission calls, so browser-based posts from unlisted origins are rejected before they reach storage, email, or webhooks.
- ✔Blocks rogue sites from consuming your monthly submission quota with leads you never asked for.
- ✔Protects public-facing endpoints on Webflow, Framer, and static hosts where the form action is visible in page source.
- ✔Simple allow-list management — add `localhost` for development, remove it at launch, and update origins without touching code. Changes apply to new submissions immediately.
Frequently Asked Questions
How do I restrict who can submit my form?
Add your site’s origins to the form’s Allowed Domains list in the dashboard. Form2Lead then enforces the list via CORS on every submission, so copies of your form action running on other websites are rejected. Combine it with the honeypot and IP rate limiting for bot traffic as well. The list lives in form settings, so tightening it after launch requires no redeploy.
Can I allow localhost during development?
Yes. Add `localhost` or your test origins to the allowed domains list in form settings while you build, and remove them when the site ships to production.
What happens when a submission comes from a domain not on my list?
Browser-based submissions from unlisted origins are rejected at the CORS layer instead of being stored or emailed — so fake leads from copycat pages never reach your inbox or count against your quota. To verify the list, post a test from an unlisted domain and confirm the rejection.
Can I use one form on multiple domains?
Yes. Add every origin that should be able to post — for example the production domain, the `*.webflow.io` preview domain, and a staging subdomain — to the same form’s allowed domains list. Each environment is matched exactly, so add new preview URLs as separate entries.
Does this replace spam filtering?
No — it is a complementary layer. Domain locking blocks other websites from posting to your endpoint, while the invisible honeypot and IP rate limiting catch automated submissions from your own legitimate pages.
Start Using Allowed Domains: CORS Origin Locking for Forms
Set up your form endpoint in under 60 seconds with zero backend code.