Skip to main content
A live Elements checkout loads only on the sites you list. Every other site gets a blocked frame, even if it copies your code. You manage the list in Store → Channels → Embed Hub → Elements → Allowed sites: Add Site puts a site on the list, and Save Changes saves it.

​
How it is enforced

Two checks run for every block:
  1. Before the frame loads, the script asks Shoppex whether the page’s origin is on the list. If it is not, the block shows “This checkout isn’t available on this site.” and your page gets the origin_not_allowed error. The console prints the origin it saw.
  2. When the frame loads, checkout.shoppex.io answers with Content-Security-Policy: frame-ancestors and your listed sites. The browser itself refuses to show the checkout inside any other site. A script that skips the first check cannot get past this one.
An empty list means a live checkout loads nowhere.

​
Rules for an entry

Changes reach your site within a minute.

​
Status per site

Each site shows Connected with the time of its last live load, or Not seen yet. Blocked recently lists the origins that tried to load your checkout in the last 7 days and were refused. Click Allow to put one on the list, then Save Changes. It is the fastest way to find the www. you forgot.

​
Test mode and local development

Test mode runs on every listed site and also on http://localhost and http://127.0.0.1 on any port, without an entry. A live checkout on localhost needs http://localhost:<port> in the list.

​
Website builders and editor previews

The browser checks every page above the checkout, not only yours. Webflow, Framer and other builders show your page inside their editor in an iframe of their own. A live checkout there is blocked unless the editor’s origin is on your list too. Test mode has the same rule, except on localhost. Your published site is not affected. If you want the checkout to show in the editor preview, add the editor’s origin. The Blocked recently list shows it after the first try.

​
A copied snippet on another site

Someone can paste your code on their own site. The block shows “This checkout isn’t available on this site.” there, and the browser refuses the frame. Your shop’s checkout runs only where you allow it.