How to Add Trusted Domains to Your Live Chat Widget
Securing Your Live Chat Widget with Trusted Domains and CORS Policy Configuration
Trusted Domains help secure your live chat widget by restricting where it can be embedded or accessed. This ensures only your approved websites can display and interact with the chat service, protecting your brand and customer data.
Note: For instructions on updating your website’s CORS settings, see:
🔗 How to Change the Referrer-Policy (CORS) Setting on Your Website
Why Use Trusted Domains?
Enabling the Trusted Domains setting ensures:
- Your chat widget loads only on allowed domains
- Unauthorized embedding is blocked
- Sensitive customer interactions remain secure
Steps to Configure Trusted Domains
Follow these steps to enable and set up trusted domains for your widget:
-
Navigate to:Admin > Chat > Live Chat.
-
Choose an existing widget or click Add Widget.
-
In General Settings, toggle Enable Trusted Domains.
-
Add a trusted domain in the provided text field.
-
Use appropriate domain patterns:
| Domain Pattern | Access Rule |
|---|---|
example.bolddesk.com |
Exact match (works for both HTTP and HTTPS) |
https://example.bolddesk.com |
HTTPS-only match |
*.bolddesk.com |
All subdomains of bolddesk.com |
*.bolddesk.com/sales |
All subdomains with /sales path |
example.bolddesk.com/sales* |
URLs starting with /sales (includes subpaths) |
example.bolddesk.com/sales |
Exact path only (no subpaths) |
-
Click Add Domain to include multiple entries.
After a Trusted Domain is added, live chat widget will render on that specific domain.
Outside of the specified domain, live chat widget will not render, and a console error indicating “not found” will be displayed.
Required: Update Your CORS Policy
Enabling Trusted Domains is not sufficient on its own. You must also configure your CORS (Cross-Origin Resource Sharing) headers and Referrer-Policy to allow the chat widget to communicate securely across origins.
Refer to this guide to update your CORS settings appropriately:
🔗 Change Referrer-Policy (CORS) Settings
