# Restrict recording to your sites with Allowed origins

**Category:** [Session Replay](https://help.totalctrl.app/hc/totalctrl/totalctrl-help-center/en-US/categories/session-replay)
**Updated:** 2026-08-19

## What "Allowed origins" does

The Session Replay SDK is installed with a public site key. By default that key accepts recordings from **any** website. **Allowed origins** lets you restrict a site key so it only accepts sessions from the domains you control — preventing someone from copying your key onto another site and consuming your recording quota.
### Where to set it

Go to **Session Replay → Settings**. Under your active site key's privacy section you'll find the **Allowed origins** box. Enter one origin per line and **Save Privacy Settings**.
### How to write an origin

An origin is the scheme plus the host (and a port only if you use one) — *no path*:

https://www.yourcompany.com
https://app.yourcompany.com

- List each subdomain you record on separately.
- `http` and `https` are different origins.
- No trailing path or slash.

### What happens when it's set

With a non-empty list, the ingest endpoint refuses recordings sent from any other origin. With an **empty list (the default)**, recordings are accepted from any site. Each site key has its own list, so you can record several domains with one key, or use separate keys with separate allowlists per property.

**Allowed origins is not the same as CSP.** Allowed origins is enforced by TotalCtrl. A *Content-Security-Policy* is enforced by the browser using *your site's* headers. If your site sends a CSP, you may also need to allow our embed domain in it — see [Why isn't the widget loading on my site?](#)

---

## Related Articles

- [Install the recording SDK](https://help.totalctrl.app/en-US/articles/install-the-sdk)
- [Privacy, masking, and GDPR controls](https://help.totalctrl.app/en-US/articles/privacy-and-gdpr)
- [Getting started: install the recorder](https://help.totalctrl.app/en-US/articles/session-replay-getting-started)
- [Heatmaps & funnels](https://help.totalctrl.app/en-US/articles/session-replay-heatmaps-funnels)
- [Frustration signals: rage clicks, dead clicks, errors & struggle score](https://help.totalctrl.app/en-US/articles/session-replay-signals)

---
[← Back to TotalCtrl Help Center](https://help.totalctrl.app/en-US/)