> ## Documentation Index > Fetch the complete documentation index at: https://wiredesk.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Allowed domains > Keep your widget key from working on anybody else's site. A widget key is public — it sits in your page source. Anyone could copy the snippet onto their own site and chat with your agent on your bill. Allowed domains stop that. Set them on the agent's **Install** page. A new widget has no list, which means it works anywhere. ## How patterns match * `example.com` covers `example.com`, `www.example.com` and `shop.example.com`. * Add `localhost` while a developer is working on the site locally. ## What happens to an unlisted site Once a list exists, it is enforced in two places: * The widget's config request answers `403` to a page on a domain nobody listed. The launcher may still draw in its default style, but it gets none of your saved settings. * The conversation frame is served with a `Content-Security-Policy: frame-ancestors` header naming your domains, so the browser refuses to show it inside any other page. Save the list before you move the widget to a new domain, not after. On a page whose domain is not listed, the chat panel will not open.