Los artículos de ayuda existen en alemán e inglés. Aquí los lees en inglés.
Instalación
Why do I have to allow domains?
The write key is visible in your page source; to stop a foreign website using it in its visitors’ browsers, the collector checks the origin of the request. If the domain is not in the allowed list, the event is rejected with DOMAIN_NOT_ALLOWED. A request from outside a browser is not stopped by this check, so it is best to report purchases from your server as well.
What does DOMAIN_NOT_ALLOWED mean and how do I add a domain?
- 01Open “Setup” and go to “Websites and allowed domains”. Below the table you find “Change allowed domains”; if you have several websites, choose the one in question there.
- 02Enter the domain without https:// and without a path, and click “Add domain”. Repeat this for every domain that should be measured, a staging address for example.
- 03The change takes effect within 30 seconds.
- 04Check in the live test that events arrive again.
Subdomains of an allowed domain are included: if example.com is on the list, Metrunio also accepts www.example.com and shop.example.com. Not the other way round: if only www.example.com is listed, nothing arrives from example.com.
“Remove” next to a domain takes it off the list again. Metrunio then accepts nothing more from the browser from there or from its subdomains; what has already been measured stays. The primary address you created the website with always stays allowed and cannot be removed. The Admin role can change domains.
Note
Add your test environment if it should be measured, and set testMode: true there so the data does not change your reports.
What the check does not do
The origin check protects against foreign websites in a browser, not against forged reports. A program outside a browser sets the origin as it likes or leaves it out, and the collector accepts requests without an origin because servers do not send one. Anyone who copies your write key from the page source can therefore report events, purchases included.
Caution
So report purchases through the Server Events API or a plugin as well. When your server reports a purchase, value and currency come from the server, even if someone reported the same order number through the browser before; “Data status” then lists ORDER_VALUE_FROM_SERVER. Without a server report, Metrunio cannot tell a forged browser purchase from a real one.
Revisado por última vez el 17 oct 2026
En el portal del cliente
También se pregunta
- DOMAIN_NOT_ALLOWED
- Allow a domain
- Measure a staging environment
- Add a subdomain
- Remove a domain
- How do I remove an allowed domain?
- Can someone misuse my write key?
Artículos relacionados
- Where do I find the site ID, write key and server key?
Which key goes where, and which one may be public?
Site ID and write key are in the portal under “Setup” and belong in the browser tracking code. You create the server key in “Setup” on the “Server Events API” tab with “Create server key”; it is secret, belongs only in your backend and is shown in full only when it is created. Read keys for Claude and your own analyses are under “Exports & AI connections”, in the “API access” section.
- No data after setup? Check these six points
No data arrives after installation. What do I check?
First: is the data processing agreement concluded? Without it Metrunio accepts nothing, and the portal shows “Measurement paused: DPA missing.”. If it is concluded, the GTM container is usually not published, consent is missing or the domain is not in the allowed list; these six steps cover the most common causes.
- What do the error codes mean?
The collector answers with a code. What does it mean?
Every rejection carries a code together with a title, explanation, data effect and resolution steps. This table lists all codes of the collector and of processing with their meaning.