What someone can copy

The embed box on your agent looks like this:

<script src="https://chatnexus.cloud/js/embed.js?id=YOUR-AGENT-ID"></script>

That ID has to be in the page, or the widget cannot load. If Allowed Domains is empty, the same ID works on any website.

What that can cost you

Your credits. Someone puts your widget on their site, or a script hits the chat URL. Every real reply uses your messages and credits. They get the answers. You hit the monthly limit.

Your name on the wrong page. A lookalike site can show your real bot, which answers helpfully as you, next to a fake checkout or a fake login. Visitors think they are talking to you.

The domain list does not stop a programmer who forges the site address in a script. A normal browser cannot do that. ChatNexus also limits how fast the chat API can be called, which slows a script down. You do not configure that limit yourself.

How to turn it on

Open the agent and edit Allowed Domains. One domain per line. You do not need https://.

yourshop.com

yourshop.com also covers subdomains, including www.yourshop.com and shop.yourshop.com. If you only type www.yourshop.com, the version without www is not included. The bare domain is the simpler line to add.

A different site needs its own line. Example: your live shop and a staging host that is not a subdomain of it.

yourshop.com
staging.example.net

Once the list has anything in it, ChatNexus checks the site address on the widget, the chat request, and voice requests. A site that is not on the list is rejected before a reply is written, so it does not use messages or credits and no chat is saved. The dashboard test chat on chatnexus.cloud still works. The check runs on the server. Removing a line of JavaScript from the widget does not bypass it.

Update the list when you move the site to a new domain. There is no screen that lists blocked attempts, so a wrong domain just looks like a widget that will not load.

For a step-by-step walkthrough, see how to lock your AI widget to your own domain.