Skip to main content
The allowed origins list names the websites that may send data into your account. It is one list for the whole account, and it covers both form submissions and tracking events. It is also the most common cause of “why is nothing being captured?”, so it is worth a few careful minutes. For why the list exists, see How Web Edge keeps your domain secure.

​
Prerequisites

  • You have the Admin or Power user role, and you can open Web Edge Sessions in your account settings. With the Standard role, you cannot change the list.
  • You know every website that will host an allGood form or the tracking tag. Include third-party platforms that serve pages for you. For example, a content platform hosting pages at yourcompany.pathfactory.com needs its own entry, or its forms and events are blocked with no warning.

​
What an origin looks like

An origin is a scheme, a host, and an optional port. Nothing else. Matching is exact. There is no subdomain inheritance. https://www.yourbrand.com does not cover https://blog.yourbrand.com or the bare https://yourbrand.com. Add every host you publish from. Leave out anything you do not recognize, because that is what keeps the list a real security boundary. A typical list looks like this:

​
Add an origin

1

Open Web Edge Sessions

Open Web Edge Sessions in your account settings and find the Allowed origins card.
The Allowed origins card, listing each website allowed to send data and whether the bot check covers it

The Allowed origins card, listing each website allowed to send data and whether the bot check covers it.

2

Enter the origin

Type the full origin, including https://, into Add an origin. Select Add.
3

Save, then wait for the status chip

Select Save in the card header. The change is not in force until the status chip reads Live at the edge.
Between saving and the chip turning green, the old list is still the one being enforced. This explains almost every “I added the origin and it still does not work” report. Wait for the chip, then test again. See Saved vs live at the edge.
Your origin is now allowed. Pages on that site can send form submissions and tracking events, as long as the other settings, such as consent and bot protection, also allow them. Every save is recorded in the change history, with who changed what and when.

​
Why a page on your own domain can work before you add anything

A landing page that allGood hosts on your subdomain, such as pages.yourbrand.com, sends data back to that same subdomain. That is the same origin, so it is always accepted, whether or not you listed it. This is why an account with an empty list can look like it works perfectly for hosted landing pages, right up until someone puts a form on the real marketing site.

​
What happens when an origin is missing

The browser refuses the request outright, and the page sees a network error with no explanation. To make this readable, the allGood script checks the page’s origin when it loads. If the origin is not allowed, the script writes a warning to the browser console that names the exact origin. Ask whoever manages the site to check the console first. The developer troubleshooting article walks through it.

​
Check bot-check coverage

If bot protection is on, each origin also shows a coverage chip.
An origin the bot check does not cover, shown alongside origins it does

An origin the bot check does not cover, shown alongside origins it does.

Coverage is read live, so it cannot be out of date. To fix an uncovered hostname, select Sync on Web Edge Sessions.

​
Where the list is stored

The card sits on Web Edge Sessions because both forms and tracking depend on it. The values are stored with your form processing settings, so the change history for origins also appears on Form processing. Both screens edit one list. Saving the list needs the Admin or Power user role, the same as every other Web Edge setting. There is no separate permission just for origins.