Embeds only work on the sites you list
- changed Leaving the Allowed origins box empty on a link's Appearance page used to let any website embed that chat widget. Now an empty box means no site can embed it: paste the domains you embed on (one per line), or the widget stays locked to your shared link. Embeds you've already set up keep working unchanged.
Every chat link can also be embedded: a small "Chat with me" button on your own site that opens the same conversation. For that to be safe, the site has to be yours, and until now that was only true by convention: leaving the Allowed origins box empty let any website embed the widget.
Any page could put your button on it. The chat itself was still protected (a visitor still had to start the conversation, and it landed in the same inbox), but your brand could appear somewhere you never chose, and the embed would look like an endorsement.
Now the box decides, and empty means closed. On the link's Appearance page, under Embed widget, paste the domains you embed on, one per line (creator.com and blog.creator.com count as separate sites). With nothing listed, the widget works only from your shared link. Embeds that were already set up before the change keep working unchanged.
← All changes