Restrict embed origins

Set allowed embed origins when you want a hosted form to work only on specific sites. Browsers then block the form from being framed elsewhere.

Set allowed origins

In the form’s Settings → Access, set allowed_embed_origins to up to 10 site origins. Each entry can be 1 to 300 characters. Use a bare origin with no path, query, or wildcard. For example:

https://www.example.com

Use https; http is accepted for localhost. An empty list allows the form to be embedded anywhere. The list is replaced as a whole when you update it.

You can also set allowed_embed_origins with the MCP tool update_form_settings.

Embed the form

On an allowed site, use the hosted embed URL:

<iframe
  src="https://makeform.ai/e/FORM_ID"
  title="Contact form"
  referrerpolicy="strict-origin-when-cross-origin"
  style="width:100%;height:600px;border:0"></iframe>

For a hand-written iframe on a page that sends no referrer, include referrerpolicy="strict-origin-when-cross-origin". Without it, a restricted form may show the restriction notice.

What visitors see

A direct visit to a restricted form shows: “This form can only be used on <site>”. A submission from a page that is not allowed fails with EMBED_ORIGIN_NOT_ALLOWED.