> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shoppex.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Allowed sites

> Choose which websites can show your Elements checkout, and what happens on every other site.

A live Elements checkout loads only on the sites you list. Every other site gets a blocked frame, even if it copies your code. You manage the list in **Store → Channels → Embed Hub → Elements → Allowed sites**: **Add Site** puts a site on the list, and **Save Changes** saves it.

## How it is enforced

Two checks run for every block:

1. **Before the frame loads**, the script asks Shoppex whether the page's origin is on the list. If it is not, the block shows "This checkout isn't available on this site." and your page gets the `origin_not_allowed` [error](/developers/elements/events#error-codes). The console prints the origin it saw.
2. **When the frame loads**, `checkout.shoppex.io` answers with `Content-Security-Policy: frame-ancestors` and your listed sites. The browser itself refuses to show the checkout inside any other site. A script that skips the first check cannot get past this one.

An empty list means a live checkout loads nowhere.

## Rules for an entry

| Rule | Example |
| - | - |
| One exact origin: scheme, host and port. A path, query or hash is removed. | `https://shop.example.com/pricing?plan=pro` is saved as `https://shop.example.com` |
| `https://` only. Plain `http://` works only for `localhost` and `127.0.0.1`. | `http://localhost:3000` is allowed. `http://shop.example.com` is not. |
| No wildcards. List every subdomain you use. | `https://*.example.com` is refused. |
| `www` and the bare domain are two sites. | List both `https://example.com` and `https://www.example.com` if both serve the page. |
| Host names are saved in lowercase, and the default port is removed. | `https://Shop.Example.COM:443` is saved as `https://shop.example.com` |
| Up to 50 sites per shop. | |

Changes reach your site within a minute.

## Status per site

Each site shows **Connected** with the time of its last live load, or **Not seen yet**. **Blocked recently** lists the origins that tried to load your checkout in the last 7 days and were refused. Click **Allow** to put one on the list, then **Save Changes**. It is the fastest way to find the `www.` you forgot.

## Test mode and local development

[Test mode](/developers/elements/test-mode) runs on every listed site and also on `http://localhost` and `http://127.0.0.1` on any port, without an entry. A live checkout on `localhost` needs `http://localhost:<port>` in the list.

## Website builders and editor previews

The browser checks **every** page above the checkout, not only yours. Webflow, Framer and other builders show your page inside their editor in an iframe of their own. A live checkout there is blocked unless the editor's origin is on your list too. Test mode has the same rule, except on `localhost`.

Your published site is not affected. If you want the checkout to show in the editor preview, add the editor's origin. The **Blocked recently** list shows it after the first try.

## A copied snippet on another site

Someone can paste your code on their own site. The block shows "This checkout isn't available on this site." there, and the browser refuses the frame. Your shop's checkout runs only where you allow it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.