Restrict a chat widget to the website domains or origins you trust by enabling the chat provider’s allowed-domain or allowed-origin control and listing only the sites that should host it. Then check that provider’s exact matching rules and test the published widget from an approved site and an unapproved one. This restriction controls where the widget’s chat functionality is available; it does not, by itself, prove who a visitor is. Use the provider’s separate visitor-authentication option when chats must be tied to signed-in accounts.
What a trusted-domain setting does—and what it does not do
A chat widget is usually loaded by code embedded in a web page. A provider’s trusted-domain or allowed-origin setting limits the sites from which that provider will make the widget’s chat functionality available or accept chat sessions. The precise behavior depends on the product: vendors may use different terms, match domains differently, or apply the rule to different widget features.
As an Amazon Associate I earn from qualifying purchases.
Domain restriction is not visitor authentication. An allowlist answers, in effect, “Which websites may host this chat?” Authentication answers, “Which visitor is this, and can the service verify that identity?” Zendesk documents its allowed domains and visitor authentication as separate settings. Amazon Connect Customer also offers JWTs for new chat requests as an optional way to help verify requests from authenticated users.
Recommended Free Tools
Do not treat an allowlist as proof that copied embed code cannot be abused in every way. The vendor documentation described here establishes product-specific availability and request controls, not a universal browser-enforcement model or a complete threat model.
#1 Best Overall
How to restrict a chat widget to your website
- Identify the installed widget and version. Check the provider, product generation, and version in the site’s embed code, admin account, or implementation notes. A provider may have separate settings for its current chat product and a legacy or classic widget.
- Find the matching allowlist setting. Look in the configuration for terms such as “Allowed Domains,” “Trusted Domains,” “Trusted URLs,” or “Allowed Origins.” Confirm that the setting applies to the widget and features actually embedded on your site.
- Add only the sites that need to host the widget. Include the production site and any legitimate support or staging site that should display chat. Do not assume that allowing a production hostname also allows a separate staging hostname.
- Read the provider’s matching rules before saving. Check whether the rule includes subdomains, whether the protocol or port must match, whether it applies to every path, and whether the vendor supports path-level rules or wildcards. Use the exact syntax the product specifies; “domain” and “origin” are not interchangeable across vendors.
- Save and publish the configuration. Follow any provider-specific deployment instructions. If the widget’s security setting generates a token or requires server changes, complete those steps before considering the setup finished.
- Test from both sides of the rule. Load the published widget from each expected site and confirm it works. Also test from a site outside the allowlist and confirm the provider blocks the chat functionality or session as documented. This is a practical verification step, not a vendor-mandated test procedure.
- Re-test after relevant changes. Repeat the checks after changing domains, deploying a different widget generation, or changing the security configuration.
Vendor rules are not interchangeable
The following comparison reflects the named products and their vendor documentation available in 2026. “Not stated” means the cited product documentation in scope does not establish that detail here; it should not be read as a claim that the product lacks the capability.
| Product and documentation scope | Documented allowlist behavior | Capacity and paths | Authentication or other security detail |
|---|---|---|---|
| Zendesk Chat and Web Widget (Classic) | Allowed Domains specifies trusted domains where Chat functionality is available. Exact scheme, port, subdomain, and path matching rules are not stated in the Zendesk documentation summarized here. | Capacity and path-level controls are not stated in the Zendesk documentation summarized here. | Visitor authentication is a separate setting and can use a JWT. Chat settings do not automatically govern other Web Widget (Classic) functionality. Source: Zendesk product documentation, accessed 2026. |
| Amazon Connect Customer communications widget | Up to 50 domains. Subdomains are included automatically; the protocol must match exactly. Chat loads on selected websites. | The rule applies to all paths beneath an allowed domain; individual subdirectories cannot be allowed or blocked. Port matching is not stated in the AWS guide summarized here. | An optional security feature uses a JWT for a new chat request. The website server generates the token; the documented token uses HS256 and has a maximum expiration of 10 minutes. AWS recommends HTTPS in production. Source: AWS product guide, accessed 2026. |
| Twilio Flex Webchat 3.x.x | Up to 10 trusted URLs can be specified as allowed origins. Further scheme, port, subdomain, and path matching details are not stated in the Twilio documentation summarized here. | Up to 10 trusted URLs; path-level controls are not stated in the Twilio documentation summarized here. | The 3.x.x security documentation also describes a randomly generated deployment key and fingerprint checks. These product-specific details are not a guarantee that origin allowlisting alone prevents every form of abuse. Source: Twilio Webchat 3.x.x security documentation, accessed 2026. |
Product-specific configuration points
Zendesk Chat and Web Widget (Classic)
Zendesk’s documentation describes Allowed Domains as a way to specify trusted domains where Chat functionality is available. Configure this for the Chat product in use, and do not assume it governs every feature of Web Widget (Classic): Zendesk says Chat settings do not automatically apply to other functionality in that widget. Zendesk also documents visitor authentication separately; it identifies signed-in visitors and can use a JWT. The documentation summarized here does not establish a domain limit or detailed scheme, port, subdomain, or path matching behavior, so do not infer those rules from another vendor’s settings.
Rank #2
- Protects against known exploits, malware and malicious websites; detects unknown attacks; identify thousands of applications
Amazon Connect Customer communications widget
AWS documents a limit of up to 50 domains for its communications widget. Subdomains are automatically included, protocol must match exactly, and the allowlist covers all paths under an allowed domain; individual subdirectories cannot be allowed or blocked. AWS recommends HTTPS in production. These are rules for this AWS widget, not general rules for other providers.
Free tools Windows power users keep installed
One-click scans. No signup required.
AWS also documents an optional security feature for new chat requests. When selected, the embed script requests a JWT generated by the website server. The documented token uses HS256 and can expire no later than 10 minutes after issuance. Keep signing secrets on the server; do not place a secret signing key in browser code. Follow the AWS implementation requirements for the token rather than applying these algorithm or expiration details to a different chat product.
Twilio Flex Webchat 3.x.x
Twilio’s Webchat 3.x.x security documentation allows up to 10 trusted URLs as allowed origins. The same documentation describes a randomly generated deployment key and fingerprint checks. Those statements are specific to this named version; the documentation summarized here does not establish matching details for schemes, ports, subdomains, or paths. Do not assume the 10-URL limit or its origin behavior applies to other Twilio products or versions.
Salesforce legacy Embedded Chat
Salesforce’s legacy “Add Your Website to the CORS Allowlist” documentation stated that Embedded Chat would be retired on February 14, 2026. That date has passed. Treat the page as historical, version-sensitive guidance rather than current setup instructions, and check Salesforce’s current product and migration status before relying on a legacy Embedded Chat workflow.
How to add visitor authentication without confusing it with the allowlist
Use visitor authentication when the chat service needs to know that a visitor is signed in or associate a conversation with a verified account. The allowlist and authentication solve different problems, so one should not be treated as a substitute for the other.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Confirm the provider supports visitor authentication for your installed widget. Zendesk documents visitor authentication separately from allowed domains; AWS documents JWTs for new requests to its Connect Customer communications widget.
- Generate signed tokens on your server. For AWS’s documented flow, the website server generates the JWT requested by the embed script. Never expose a signing secret in page source or client-side JavaScript.
- Follow the product’s token requirements exactly. For the AWS widget, the documented token uses HS256 and has a maximum expiration of 10 minutes. These are AWS-specific constraints, not cross-vendor JWT defaults.
- Test both identity and site restrictions. Verify that an authenticated visitor is represented as expected and that an origin outside the allowlist remains blocked. Passing one test does not establish that the other control is working.
Troubleshooting an unavailable widget
- Check the hostname and protocol. A typo, an unlisted staging host, or a protocol mismatch can keep an otherwise valid site from matching. For AWS, the protocol must match exactly.
- Check the intended scope. Confirm that you configured the allowlist for the widget product and generation that the site actually loads. Zendesk specifically separates Chat settings from other Web Widget (Classic) functionality.
- Check whether the requested page can be covered. AWS’s rule applies to all paths under an allowed domain and does not support allowing or blocking individual subdirectories. Do not expect a path restriction if your provider’s documented behavior does not offer one.
- Repeat the out-of-list test. A widget working on the production site confirms only that the expected site can use it; it does not confirm that the restriction blocks an unlisted site.
Frequently Asked Questions
Can trusted-domain settings use the same wildcard syntax across chat providers?
No universal syntax is established by the vendor documentation summarized here. AWS explicitly includes subdomains automatically, while the cited Zendesk and Twilio materials do not establish equivalent matching details. Use the exact matching rules documented for the installed product rather than copying a pattern from another platform.
Best Value
![ZyXEL ZyWALL (USG) UTM Firewall, Gigabit Ports, for Small Offices, 20 IPSec VPN, 5 SSL VPN, Limited, Hardware Only [USG40-NB]](https://m.media-amazon.com/images/I/31HNlmmmCnL._SL160_.jpg)
- Perfect for small offices: High performance ICSA-certified Gigabit UTM firewall delivers fast speeds of 400 Mbps (FW), 100 Mbps (VPN) and 50 Mbps UTM for 50,000 sessions
- Robust and secure VPN options (SSL, L2TP and IPSec) ensure excellent site-to-site, client-to-site and mobile-to-site connectivity with 20 IPSec Tunnels and 5 SSL Upgradable to 15
- 30 Day Free Trial of best-in-class antivirus, anti-malware, anti-spam, content filtering, intrusion detection and next-generation application intelligence from TrendMicro and other industry leaders
- Limited lifetime hardware warranty, free firmware upgrades and free technical support (90 days upon registration)
- Quiet, fanless design makes an ideal deployment in small offices
Does an allowed-domain rule restrict chat to a single page?
Not for the AWS Connect Customer communications widget: its allowed-domain rule applies to all paths under the domain, and AWS says individual subdirectories cannot be allowed or blocked. The documentation summarized here does not establish page-level matching behavior for the cited Zendesk and Twilio products.
Does allowing a domain mean every feature in an embedded widget is restricted the same way?
Not necessarily. Zendesk specifically says its Chat settings do not automatically govern other Web Widget (Classic) functionality. Check the scope of the setting for the exact widget features you use.
Frequently Asked Questions
Can trusted-domain settings use the same wildcard syntax across chat providers?
No universal syntax is established by the vendor documentation summarized here. AWS explicitly includes subdomains automatically, while the cited Zendesk and Twilio materials do not establish equivalent matching details. Use the exact matching rules documented for the installed product rather than copying a pattern from another platform.
Does an allowed-domain rule restrict chat to a single page?
Not for the AWS Connect Customer communications widget: its allowed-domain rule applies to all paths under the domain, and AWS says individual subdirectories cannot be allowed or blocked. The documentation summarized here does not establish page-level matching behavior for the cited Zendesk and Twilio products.
Does allowing a domain mean every feature in an embedded widget is restricted the same way?
Not necessarily. Zendesk specifically says its Chat settings do not automatically govern other Web Widget (Classic) functionality. Check the scope of the setting for the exact widget features you use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
