> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allgoodhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How Web Edge keeps your domain secure

> What domains and subdomains are, and why allowed origins, subdomain registration, SSL, and bot protection each matter for security.

## Domains and subdomains, in plain terms

Your domain is your main web address — `yourbrand.com`. A subdomain adds a label in front of it. It can point somewhere entirely different while still living under your brand. `www.yourbrand.com`, `go.yourbrand.com`, and `info.yourbrand.com` are all subdomains of `yourbrand.com`. You likely already have one — `www` is a subdomain too.

allGood uses this same idea. Rather than hosting your landing pages on a generic address like `random-id.allgoodmk.dev`, you register a subdomain of your own brand, such as `pages.yourbrand.com`. You point that subdomain at allGood. Visitors see your domain in the address bar the whole time — allGood does the hosting behind the scenes.

Registering a subdomain doesn't touch your main website. Adding `pages.yourbrand.com` has no effect on `yourbrand.com` or `www.yourbrand.com` — you're claiming a new, separate address under your domain and telling it where to go.

## Why this matters

**Allowed origins stop imposters from using your form.** A form or tracking snippet is code, and code can be copied. Without an allowed-origins list, someone could lift your form's HTML and host it on their own site. That copy could feed fake leads straight into your database, or a copied tracking snippet could report activity from a page that isn't yours. Allowed origins tell allGood to accept submissions and tracking events only from your own site.

**Registering a subdomain proves you actually own it.** Before allGood hosts anything on `pages.yourbrand.com`, it needs proof that you — not someone else — control that address. The DNS records you'll add are that proof, because only the person who manages your domain's DNS can add them. This is the same ownership check used across the web to issue website security certificates, so it can't be skipped or faked.

**That certificate is what puts the padlock in the browser.** Once your domain is verified, allGood issues it a certificate that encrypts traffic between your visitors and your page. That certificate also confirms to the browser that the page is really yours, not a look-alike. Without it, browsers flag the page as **Not secure**, which costs you trust right when someone's about to fill out a form.

**Bot protection keeps your data clean.** Automated bots submit forms at scale — scraping email addresses into spam lists, flooding your database with junk leads, or padding your conversion numbers with fake submissions. Bot protection screens these out before they reach your database, so the leads and conversions you see are real people.

If anything here doesn't match what you see on your **Web Edge Sessions** page, contact allGood support — settings may have changed since this was written.

## Related articles

* [Set up Web Edge Sessions for your site](/mk/settings/web-edge/sessions-setup)
* [Set up Web Tracking on your site](/mk/settings/web-edge/tracking-setup)
* [Turn on bot protection for a form](/mk/settings/web-edge/bot-protection)
* [Web Edge domain vs. email domain](/mk/settings/email/domains-vs-web-edge)