---
slug: erlaubte-domains
title: "Why do I have to allow domains?"
category: installation
locale: en
updated: 2026-10-17
keywords: ["domain","allowed domains","DOMAIN_NOT_ALLOWED","origin","staging"]
questions: ["What does DOMAIN_NOT_ALLOWED mean and how do I add a domain?","DOMAIN_NOT_ALLOWED","Allow a domain","Measure a staging environment","Add a subdomain","Remove a domain","How do I remove an allowed domain?","Can someone misuse my write key?"]
url: https://bench.metrunio.com/en/help/erlaubte-domains
---

# Why do I have to allow domains?

**What does DOMAIN_NOT_ALLOWED mean and how do I add a domain?**

The write key is visible in your page source; to stop a foreign website using it in its visitors’ browsers, the collector checks the origin of the request. If the domain is not in the allowed list, the event is rejected with DOMAIN_NOT_ALLOWED. A request from outside a browser is not stopped by this check, so it is best to report purchases from your server as well.

1. Open “Setup” and go to “Websites and allowed domains”. Below the table you find “Change allowed domains”; if you have several websites, choose the one in question there.
2. Enter the domain without https:// and without a path, and click “Add domain”. Repeat this for every domain that should be measured, a staging address for example.
3. The change takes effect within 30 seconds.
4. Check in the live test that events arrive again.

Subdomains of an allowed domain are included: if example.com is on the list, Metrunio also accepts www.example.com and shop.example.com. Not the other way round: if only www.example.com is listed, nothing arrives from example.com.

“Remove” next to a domain takes it off the list again. Metrunio then accepts nothing more from the browser from there or from its subdomains; what has already been measured stays. The primary address you created the website with always stays allowed and cannot be removed. The Admin role can change domains.

> **Note:** Add your test environment if it should be measured, and set testMode: true there so the data does not change your reports.

## What the check does not do

The origin check protects against foreign websites in a browser, not against forged reports. A program outside a browser sets the origin as it likes or leaves it out, and the collector accepts requests without an origin because servers do not send one. Anyone who copies your write key from the page source can therefore report events, purchases included.

> **Caution:** So report purchases through the Server Events API or a plugin as well. When your server reports a purchase, value and currency come from the server, even if someone reported the same order number through the browser before; “Data status” then lists ORDER_VALUE_FROM_SERVER. Without a server report, Metrunio cannot tell a forged browser purchase from a real one.

## Also asked

- DOMAIN_NOT_ALLOWED
- Allow a domain
- Measure a staging environment
- Add a subdomain
- Remove a domain
- How do I remove an allowed domain?
- Can someone misuse my write key?

## Related

- https://bench.metrunio.com/en/help/site-id-und-write-key
- https://bench.metrunio.com/en/help/warum-keine-pageviews
- https://bench.metrunio.com/en/help/error-codes