Security and control Available on Pro
Control who can reach you and where your button appears.
Lock your widget to approved domains and block unwanted IP addresses. Everything is enforced on our servers so your button cannot be abused.
What you actually get
Locked to your domains
List up to twenty domains that may run your widget. Anywhere else it refuses to load, so a copied embed code on someone else's site is worthless.
Enforced on the server
The check happens server-side, not in the browser. Client-side restrictions are a suggestion; this one cannot be edited away in devtools.
Block the addresses you need to
An IP blocklist of up to a hundred entries stops persistent abuse from a known source without affecting anyone else.
Common questions
Which plan includes this?
- Pro and above, for both domain lock and IP blocking.
Why does server-side enforcement matter?
- Because anything enforced in the browser can be turned off in the browser. Your embed code is public by nature, so the restriction has to live somewhere the visitor cannot reach.
Are webhooks protected too?
- Outbound webhooks are guarded against server-side request forgery, and retry with idempotency so a delivery is not duplicated or lost.
Tomorrow's conversations are already visiting your website today.
The opportunity isn't only getting more visitors. It's connecting with the ones you already have, before their interest fades.
One line of code. No credit card. No waiting.