Restricting Form Submissions by Origin

Once your form endpoint is public, anyone who views your page source can see the URL and post to it from their own scripts. For many forms that is fine. For others — a private waitlist, an internal tool, a form you want tied to one site — you want to lock it down.

What an Origin Allowlist Does

Browsers send an Origin header identifying the site a request came from. An origin allowlist tells the endpoint to accept submissions only from the domains you list and reject the rest. A scraper posting from its own server sends a different origin and gets turned away.

Setting It Up

List the origins that are allowed to submit — for example your production domain and a staging domain:

https://example.com, https://staging.example.com

Leave it empty to accept submissions from anywhere, which is the right choice for a public contact form embedded on multiple sites.

What It Does and Doesn't Solve

Origin checks stop casual cross-site abuse and scraper bots. They are not a substitute for spam filtering, because a determined attacker can still submit from a real browser on an allowed page. Use origin allowlisting together with a honeypot and rate limiting for layered protection.

A Note on Testing

Remember that requests without an Origin header — some server-to-server tools, certain curl calls — may bypass the check by design, since the allowlist only applies when an origin is present. If you need strict server-side submissions, pair the form with an API key flow instead.

---

Lock your form to your own domain with an origin allowlist. Try Bluejay Forms free.