Skip to content
donorfinch

Website & embeds

Allowed websites, site keys and embeds

Why forms only load on sites you've approved, how site keys work, and what to do when a form shows "not allowed here".

2 min read · Updated October 31, 2026

Your donation forms carry your organization's name and take money. So they only render on websites you've approved, listed under Settings → Website → Allowed websites.

How a site gets on the list

  • Automatically when you connect through the WordPress plugin or the Wix app.
  • By hand: enter the Website address (e.g. https://www.example.org) and an optional Label. Subdomains are separate: www.example.org and donate.example.org each need their own entry.
  • The hosted page app.donorfinch.com/give/… always works; it's ours.

The table shows each site's type, default form and when it last loaded a form, with Remove.

"This form isn't allowed on this website"

That message means the page's domain isn't on the list. Common causes:

  • You added example.org but the page is on www.example.org.
  • A staging or preview domain (mysite.webflow.io, preview.squarespace.com).
  • The page is inside another site's iframe (some page builders' preview panes).

Add the exact domain shown in the browser's address bar and reload.

Site keys

A site key is what the WordPress plugin (and other integrations) use to list your forms. Create them under Settings → Website → Site keys; name each after the site it's for. A key is shown once when created.

  • Keys can list published forms and register the site as allowed. They can't read donors, gifts or settings.
  • Revoke a key any time; the plugin on that site stops listing forms, but embeds already placed keep working because they rely on the allowed-websites list, not the key.
  • Rotate the key if a developer who had it leaves.

The embed snippet

<script src="https://app.donorfinch.com/embed/v1.js"
        data-form="your-org/general" async></script>

Options: data-mode="button" (a button that opens a popup) with data-label="Donate", and data-amount, data-interval (once/monthly/yearly), data-fund, data-campaign to pre-select. The script is tiny, loads asynchronously, and renders the form in a secure frame served by DonorFinch, so card data never touches your page. Developers can listen for a donorfinch:donation event on the page to run their own code after a gift.

Content security policy

If your site sends a strict CSP header, allow https://app.donorfinch.com in script-src and frame-src. Most site builders don't need this.

Related