Website Chat Security and Restrictions

The Security and Restrictions tabs of a website chat decide where the Resool chat widget may load and who sees it. Security keeps your widget from being copied onto other websites, controls how visitor privacy choices and cookies are handled, and adds anti-bot protection if spammers target your chat. Restrictions hide the chatbox on specific pages, for visitors from certain countries, browser languages or IP addresses, or everywhere at once while your team is on vacation.

#Before you begin

• Create a website chat first. See Website Chat Quick Start.
• Only Owners and Admins (or a custom role with Connect and configure channels) can change these settings.
• To lock the chatbox to your own domain, set your website under Settings › Workspace first. See Workspace settings.
• Changes on the Security tab and the rule lists on Restrictions are saved with the save bar at the bottom.

#How to restrict where the chatbox loads

1. Go to Settings › Channels and click Manage on your website chat.
2. Open the Security tab.
3. Under General Options:
   • Turn on Lock the chatbox to website domain (and subdomains) so only your workspace website and its subdomains can load it.
   • Under Allowed websites, type a domain and press Enter, for example acme.com, shop.acme.com or *.acme.com. Add every site that should show the chatbox. Leave the list empty to allow any website.
4. Click Save.

Screenshot placeholder

Settings › Channels › a Live chat channel › Security

The Security tab with General Options (the Lock switch on with the hint naming acme.com, and Allowed websites chips acme.com and *.acme.com), Privacy (two switches with their status labels) and Anti-Bot Protections (level dropdown on Default (Recommended)).

File: screenshots/website-chat-security-tab.png

#How to set privacy options

Under Privacy on the Security tab:

• Ignore user privacy choices (MagicType, MagicBrowse): by default, when a visitor's browser sends Do Not Track or Global Privacy Control, live drafts (MagicType) and country detection are turned off for them. The label shows Privacy choices honored. Turn this on only if you need to ignore those signals.
• Do not auto-create chat sessions and cookies without user intent: nothing is stored in the visitor's browser until they open the chatbox. The label shows Total Privacy™ is active. Useful when your cookie policy requires consent.

#How to protect the chatbox from bots

1. Under Anti-Bot Protections, open Anti-bot protection level (only enable if under attack).
2. Choose a level:
   • Default (Recommended): no extra challenge.
   • Challenge all users (Easy), (Medium) or (Hard).
   • I'm under attack (Extreme).
3. Click Save.

With a challenge level, the visitor's browser solves a small proof-of-work puzzle before each new chat session. It's invisible to people but makes it costly for bots to open many chats. Higher levels take longer on slow devices, so go back to Default when the attack is over.

#How to hide the chatbox with restrictions

Open the Restrictions tab. Rules are checked every time the chatbox loads.

Screenshot placeholder

Settings › Channels › a Live chat channel › Restrictions

The Restrictions tab with the vacation switch, the "Show chatbox only on pages" list with /pricing, "Hide chatbox on pages" with /checkout/*, a blocked country, an empty locales list, a blocked IP range, and the Blocked visitors section with View and Clear all block rules.

File: screenshots/website-chat-restrictions-tab.png

Type a rule and add it with the button under its list, for example Add a blocked page, then click Save. Use to match anything, for example https://shop.acme.com/.

#How to manage blocked visitors

Under Blocked visitors you see how many visitors are blocked. You block or unblock a visitor from their conversation in the Inbox; their messages are then dropped.

• Click View to see the blocked contacts.
• Click Clear all block rules (IP & Email) and confirm to allow every blocked IP address and every blocked visitor again.

#Notes and limitations

• Up to 100 rules each for allowed pages, hidden pages and locales; 250 countries; 500 IP rules.
• A hidden chatbox leaves no trace on the page: visitors don't see a button at all.
• Country detection is approximate. It uses a location signal from the network when available, otherwise the visitor's time zone and browser settings.

#FAQ and troubleshooting

#The chatbox disappeared from my website. What can I do?

What you can do:

• Check that Place support in vacation is off.
• Check Allowed websites and the lock switch on Security: your current domain must be allowed.
• Check the page, country, locale and IP lists on Restrictions.
• On the Behavior tab, check Hide the chatbox if all operators are away and Hide the chatbox on mobile devices.

#Why is the lock switch greyed out?

Your workspace has no website set. Add it in Settings › Workspace, then come back.

#Should I turn on anti-bot protection all the time?

No. Keep Default (Recommended) unless bots are flooding your chat. Higher levels add a short delay for every new visitor.

#How do I avoid setting cookies before a visitor opens the chat?

Turn on Do not auto-create chat sessions and cookies without user intent. Nothing is stored in the visitor's browser until they open the chatbox. See Contact data privacy for handling personal data.

#What's next?

• Website chat appearance and behavior
• Website Chat Quick Start
• Contact data privacy