# Choose which websites can show the widget

_Category: Widget and embeds_

Your widget and your embedded help center only load on websites you approve. Add each website that shows them to your embedding origins, so nobody else can put your help center on their pages.

**Who can do this:** Owners and Admins · **Plans:** All plans

## Add a website

1. In the left menu, click the gear icon, then **Settings**.
2. In the **General** card, find **Embedding origins**.
3. Type the host name of a website that shows your widget, such as `app.example.com`, and click **Add** (or press Enter).
4. Add your other websites the same way: production, staging, a second brand or a partner's site.
5. Click **Save changes**.

![Screen recording. Under Embedding origins, add the site that shows your widget. A leading dot covers every subdomain. Click Save changes.](https://helpcenter-io.s3.amazonaws.com/uploads/self/SwdRQFTVx9bpPQ1ny4oVKkgkxHOxDnDeswlwj8VT.gif)
Add every website that shows your widget or embedded help center.

You can edit the same list from **Embeddables** → **Widget** → **Configuration**. A change in one place shows in the other.

## What to enter

- **A host name**, like `www.example.com`. If you paste a full address, such as `https://www.example.com/support`, only the host is kept.
- **Every version of your domain.** `example.com` and `www.example.com` are different hosts. Add both, or use a leading dot.
- **A leading dot to cover subdomains.** `.example.com` covers `example.com` and every subdomain, such as `app.example.com` and `www.example.com`. If you type `*.example.com`, it's saved as `.example.com`.
- **localhost for testing the widget locally.** For the widget, ports don't matter, so `localhost` also covers `localhost:3000`.

## What the list refuses

When an entry can't be saved, the reason shows next to it. The list refuses:

- **Anything that isn't a host name**, such as a bare `*`, which would let every website embed your help center.
- **A wildcard over a domain ending anyone can register under**, such as `.com` or `.co.uk`.
- **A wildcard over a host shared by many unrelated websites**, such as `.vercel.app`, `.github.io` or `.myshopify.com`. Add your own site's host there instead, such as `yoursite.vercel.app`.
- **A wildcard over an IP address or localhost.**
- **More than 50 entries.** Use a leading dot to cover the subdomains of one domain.

Entries you saved before these rules stay on the list.

## What the list controls

Embedding origins decides where these can load:

- The widget, and its proactive messages.
- Your help center embedded in your website or app. See [Embed your help center in your app](https://developers.helpcenter.io/content/embed-your-help-center) on the developer portal.
- Your help center when [JS-only access](https://self.helpcenter.io/content/js-only-access) is on.

FAQ sections have their own list of websites, **Display on URLs**. See [Embed FAQ sections on your website](https://self.helpcenter.io/content/faq-sections).

The list decides where your help center can be shown, not who can read it. To keep content private, see [Control who can see your help center](https://self.helpcenter.io/content/who-can-see-your-help-center).

An empty list doesn't mean "allow everyone". With no embedding origins, the widget and embeds are blocked on every website, and Settings shows a **No embedding origins** warning.

## Troubleshooting

**The widget doesn't show, and Embeddables shows Blocked recently.** When the widget loads on a website that isn't on the list, it stays hidden, and **Embeddables** → **Widget** lists that website under **Blocked recently**, with the five most recent kept for 30 days. Until the widget is installed, the page header also says **Blocked on 1 domain** (or more). Click **Allow** next to each website that's yours, then click **Save changes**.

**The widget or embed doesn't show.** Compare the address of your page with the list: its host must be on the list exactly, or be covered by an entry with a leading dot. After you save, wait a couple of minutes and reload.

**Your browser console says "Parent domain is not in the allowed list."** Add the host it names.

**Your page sits inside another tool**, such as a dashboard or a site builder's custom code block. Every page in that chain must be on the list. See [Embed your help center in your app](https://developers.helpcenter.io/content/embed-your-help-center) on the developer portal.

**You can't change the list.** Only Owners and Admins can. Ask one of them to add the website.

## Related articles

- [Add the widget to your website](https://self.helpcenter.io/content/install-the-widget)
- [Show your help center only inside your app](https://self.helpcenter.io/content/js-only-access)
- [The widget doesn't show up](https://self.helpcenter.io/content/widget-not-showing)
- [Content Security Policy and allowed origins](https://developers.helpcenter.io/content/content-security-policy) on the developer portal