Docs

Allowed domains

The list of sites a form belongs to. It decides where a redirect may send people, and which origins a browser-restricted form accepts.

3 minWorks on every planUpdated Sep 22, 2026

What the list does

Each form has a list of allowed domains under Allowed domains in its settings. The endpoint uses it for two things:

  • Redirects. After a plain HTML post, the browser is only sent to a _mtf_redirect address whose domain is on the list. Anything else lands on the plain success page. This is what stops your endpoint being used as an open redirect.
  • Origin checks. As soon as the list has a domain, the form refuses any browser submission whose Origin header is not on it, with origin_not_allowed (403). Remove the last domain and the form accepts posts from anywhere again.
A request with no Origin is refused too. While the list has a domain, a server that posts to the public endpoint without an Origin header (a Next.js Server Action, a cron job, curl) gets origin_not_allowed. Send server-side submissions to the API with a secret key, which origin checks do not apply to.
Domains added before 2026-09-23 Lists created before origin checks existed are not enforced until you turn them on: the form's Settings shows Not enforced yet with an Enforce these domains button. Check the list covers every address your form runs on first.
  1. 1

    Add your domain

    Open the form, go to Settings, and type the domain into Add allowed domain. You can paste a bare domain or a full URL; it is stored as an origin, meaning scheme, host and port, with any path dropped.

    You typeStored as
    example.comhttps://example.com
    https://www.example.com/contacthttps://www.example.com
    http://localhost:3000rejected: needs a dot in the host
    http://staging.example.com:8080http://staging.example.com:8080

    Matching is exact. https://example.com does not cover https://www.example.com or http://example.com, so add each one your pages are actually served from.

  2. 2

    Send people to your own thank-you page

    Add the hidden _mtf_redirect field with an absolute URL on one of those domains. After a successful post the browser gets a 303 to that address.

    HTML
    <form action="https://mtform.co/f/your-form-key" method="POST">
  <input type="hidden" name="_mtf_redirect" value="https://example.com/thanks">

  <label>
    Email
    <input type="email" name="email" required>
  </label>

  <button type="submit">Send</button>
</form>

    The path and query string are kept; a #fragment is dropped. Relative URLs, non-HTTP schemes and URLs with a username or password in them are ignored, and the visitor sees the plain success page instead.

  3. 3

    Check it

    Submit the form from your site. If you land on the plain success page rather than your own, the redirect's origin is not on the list: compare scheme, www and port character for character.

    JSON callers are never redirected. A request sent with Accept: application/json gets the JSON body whatever _mtf_redirect says. Navigate in your own code after a successful response, as the fetch guide shows.

When an origin is refused

On a browser-restricted form, a post with no Origin header, or one not on the list, is refused before its body is read. A JSON caller gets:

CodeHTTPMessage
origin_not_allowed403This form does not accept submissions from that address.

Server-to-server calls made with an API key skip the origin check entirely, because a backend has no meaningful origin. See server-side submissions.

Next steps

Spam filteringHoneypot, block rules and the Turnstile challenge.HTML formsEvery control field a plain form can send.Rate limitsWhat happens when one address posts too fast.