> ## Documentation Index > Fetch the complete documentation index at: https://docs.allgoodhq.com/llms.txt > Use this file to discover all available pages before exploring further. # Set your allowed origins > List the websites allGood will accept form submissions and tracking events from, and avoid the most common cause of nothing being captured. The **allowed origins** list names the websites that may send data into your account. It is one list for the whole account, and it covers both form submissions and tracking events. It is also the most common cause of "why is nothing being captured?", so it is worth a few careful minutes. For why the list exists, see [How Web Edge keeps your domain secure](https://docs.allgoodhq.com/mk/settings/web-edge/how-it-works.md). ## Prerequisites * You have the **Admin** or **Power user** role, and you can open **Web Edge Sessions** in your account settings. With the **Standard** role, you cannot change the list. * You know every website that will host an allGood form or the tracking tag. Include third-party platforms that serve pages for you. For example, a content platform hosting pages at `yourcompany.pathfactory.com` needs its own entry, or its forms and events are blocked with no warning. ## What an origin looks like An origin is a scheme, a host, and an optional port. Nothing else. | Example | Valid? | Why | | - | - | - | | `https://www.yourbrand.com` | Yes | | | `http://localhost:3000` | Yes | A port is fine. | | `https://yourbrand.com` | Yes | It is a different origin from `www.yourbrand.com`. | | `https://www.yourbrand.com/` | No | Trailing slash. | | `https://www.yourbrand.com/landing` | No | Paths are not part of an origin. | | `https://*.yourbrand.com` | No | No wildcards, ever. | | `www.yourbrand.com` | No | The scheme is required. | Matching is exact. There is no subdomain inheritance. `https://www.yourbrand.com` does not cover `https://blog.yourbrand.com` or the bare `https://yourbrand.com`. Add every host you publish from. Leave out anything you do not recognize, because that is what keeps the list a real security boundary. A typical list looks like this: ``` https://www.yourbrand.com production site https://yourbrand.com the bare domain, if it serves pages https://blog.yourbrand.com if the blog is a separate host https://staging.yourbrand.com staging, while you test http://localhost:3000 local development; remove before go-live ``` ## Add an origin **1. Open Web Edge Sessions** Open **Web Edge Sessions** in your account settings and find the **Allowed origins** card. ![The Allowed origins card, listing each website allowed to send data and whether the bot check covers it](https://mintcdn.com/allgoodtechnologyinc/bf1LRHwyriZvgDxT/images/mk/web-edge/setup-allowed-origins-card.png?fit=max\&auto=format\&n=bf1LRHwyriZvgDxT\&q=85\&s=a57b80a1d52849cda10d08629e50111d) The Allowed origins card, listing each website allowed to send data and whether the bot check covers it. **2. Enter the origin** Type the full origin, including `https://`, into **Add an origin**. Select **Add**. **3. Save, then wait for the status chip** Select **Save** in the card header. The change is not in force until the status chip reads **Live at the edge**. > [!WARNING] > > Between saving and the chip turning green, the old list is still the one being enforced. This explains almost every "I added the origin and it still does not work" report. Wait for the chip, then test again. See [Saved vs live at the edge](https://docs.allgoodhq.com/mk/settings/web-edge/edge-sync.md). Your origin is now allowed. Pages on that site can send form submissions and tracking events, as long as the other settings, such as consent and bot protection, also allow them. Every save is recorded in the change history, with who changed what and when. ## Why a page on your own domain can work before you add anything A landing page that allGood hosts on your subdomain, such as `pages.yourbrand.com`, sends data back to that same subdomain. That is the same origin, so it is always accepted, whether or not you listed it. This is why an account with an empty list can look like it works perfectly for hosted landing pages, right up until someone puts a form on the real marketing site. ## What happens when an origin is missing The browser refuses the request outright, and the page sees a network error with no explanation. To make this readable, the allGood script checks the page's origin when it loads. If the origin is not allowed, the script writes a warning to the browser console that names the exact origin. Ask whoever manages the site to check the console first. The [developer troubleshooting article](https://docs.allgoodhq.com/mk/developer/web-edge/troubleshooting.md) walks through it. ## Check bot-check coverage If bot protection is on, each origin also shows a coverage chip. | Chip | Means | | - | - | | **bot check covered** | The widget issues tokens on this hostname. | | **bot check not covered** | It does not. A form here that requires a bot check has every submission refused. | ![An origin the bot check does not cover, shown alongside origins it does](https://mintcdn.com/allgoodtechnologyinc/bf1LRHwyriZvgDxT/images/mk/web-edge/setup-allowed-origins-uncovered.png?fit=max\&auto=format\&n=bf1LRHwyriZvgDxT\&q=85\&s=651225e12356d87589e2d00cbf017eb8) An origin the bot check does not cover, shown alongside origins it does. Coverage is read live, so it cannot be out of date. To fix an uncovered hostname, select **Sync** on **Web Edge Sessions**. ## Where the list is stored The card sits on **Web Edge Sessions** because both forms and tracking depend on it. The values are stored with your form processing settings, so the change history for origins also appears on [Form processing](https://docs.allgoodhq.com/mk/settings/web-edge/form-processing.md). Both screens edit one list. Saving the list needs the Admin or Power user role, the same as every other Web Edge setting. There is no separate permission just for origins. ## Related articles * [Connect a subdomain](https://docs.allgoodhq.com/mk/settings/web-edge/connect-a-subdomain.md) * [Saved vs live at the edge](https://docs.allgoodhq.com/mk/settings/web-edge/edge-sync.md) * [Turn on bot protection for a form](https://docs.allgoodhq.com/mk/settings/web-edge/bot-protection.md) * [Web Edge FAQ](https://docs.allgoodhq.com/mk/settings/web-edge/faq.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.