I'm trying to figure out what the new Domain Whitelist for CloudPages actually does (in Setup > Security > Domain Whitelist).

Domain Whitelist

I attended a Dreamforce '19 session which had a slide on this feature, which explained:

Protects CloudPage-created websites from malicious actors using URLs that redirect customers to unapproved sites.

There is a 'Learn More' link on the page which goes to a 404 error page and I can't find any documentation on this feature.

I would assume that this would only display the CloudPage landing page if the HTTP Referer Header is from a whitelisted domain. However, I've tested that and it's not the case. If I:

  1. Create a new page at mydomain.com with a link to a CloudPage
  2. Click on the Link
  3. Inspect the request headers to see that the Referer URL is https://mydomain.com/cp-test.html

...then the link works even if mydomain.com is not part of the whitelist.

Can someone clarify what this feature actually does?

1 Answer 1


Domain whitelist is intended to store domains to which you can perform redirects on form submission in Cloud Pages or in Smart Capture forms. Let's say you host a form on Cloud Page hosted on e.g. marketing.ampscript.guide and want it to redirect to sprignaturemoves.com, your form submission will fail, if domain whitelisting is enabled, but sprignaturemoves.com is not added to the list of whitelisted domains. Same with Smart Capture forms hosted outside of Cloud Pages.

So it is indeed the other way around from what you were testing, it is not inbound validation (checking HTTP Referer Header), but outbound validation (checking the destination domain of a redirect).

  • That makes sense, thanks! Jan 14, 2020 at 8:43
  • You’re welcome. TBH I haven’t tested this myself yet, relying only on what I’ve heard - so do let me know if I’m entirely wrong. Jan 14, 2020 at 8:45
  • 2
    I see what you did there. ;) Jan 14, 2020 at 12:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .