---
schema_version: "1"
id: 63a492b4d7a8fcf15f0e6bb8091d3812fddbb54674982a1d3436b5a370c7cb34
title: Set Security Protocols for Your Messaging for Web Deployment
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/miaw_security.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.miaw_security.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: fba83902798a4eee8c7a5b6b8dc463a3935f111b1badd3a7a292fd4b787c2a70
description: To successfully use Messaging for Web, add your experience site or external website domain to a Cross-Origin Resource Sharing (CORS) allowlist. If you change your domain, remember to update the CORS allowlist.
products:
  - Service Cloud
  - Digital Engagement
release: "264"
---
# Set Security Protocols for Your Messaging for Web Deployment

To successfully use Messaging for Web, add your experience site or external website domain to a Cross-Origin Resource Sharing (CORS) allowlist. If you change your domain, remember to update the CORS allowlist.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;"><a href="https://help.salesforce.com/s/articleView?id=service.messaging_editions.htm&amp;type=5&amp;language=en_US" target="_blank">View supported editions</a>.</td></tr></tbody></table>

The CORS allowlist lets web browsers request resources from other origins, like allowing access to supported Salesforce APIs, Apex REST resources, and Lightning Out from JavaScript code in a web browser.

You must add any domain that you use, from testing to production, to your CORS allowlist. For example, if you start in a sandbox and then deploy to production, add both the sandbox and the production domains.

## Add Your External Website Domain to a CORS Allowlist

After completing setup, add your domain to the CORS allowlist. Add your CORS allowlist entries of URLs for the pages where you deploy messaging. The page you add is where customers access the messaging window. The origin URL pattern must include the HTTP or HTTPS protocol and a domain name. The wildcard character (\*) is supported and must be in front of a second-level domain name. For example, https://\*.example.com (https://%2A.example.com/) adds all subdomains of example.com (http://example.com/) to the allowlist.

1. From Setup, enter CORS in the Quick Find box, and then select **CORS**.
2. Select **New**.
3. Enter an origin URL pattern.
4. Save your work.

## Add Your Experience Builder Site Domain to a CORS Allowlist

After completing setup, add your Experience Builder site domain to your CORS allowlist. If notice an issue with the \*.live-preview domain, add that to the CORS allow list.

1. To confirm your site domain, from Setup, enter Digital Experiences in the Quick Find box, and then select **Settings**. Copy the URL from the Domain section.
2. From Setup, enter CORS in the Quick Find box, and then select CORS.
3. Select **New**.
4. Enter an origin URL pattern.
5. Save your work.