To prevent unauthorized domains from using your search engines, access is restricted by default so only whitelisted domains can use them.
Authorized Domains
Doofinder uses CORS (Cross Origin Resource Sharing) to protect your search engines. This means that only whitelisted domains can perform requests client-side to your search engines.
To configure which domains you want to grant client-side access to a search engine you have to access Configuration > Domain Security > Authorized domains section in your Admin Panel. Select the Search Engine for which you want to configure domains from the top menu.
Doofinder enables your main domain by default and *.doofinder.com too so you can use search from the Control Panel. That's why you usually have to do nothing to have Doofinder working in your own site.
Say you own a Search Engine for an eCommerce website accessible at https://www.mysafeshop.com. In the Domain Security screen you will probably see how *.mysafeshop.com is whitelisted inside Authorized Domains.
If you want your users to search in www.mysafeshop.com from another site, for instance https://www.myfriendsshop.com you will have to authorize that domain by adding a new entry to Authorized Domains. Just enter www.myfriendsshop.com and save.
How Patterns Work
Websites use domain names, and domain names have subdomains: www.doofinder.com is a subdomain of doofinder.com.
To prevent big lists of authorized domains you can use patterns with wildcards to match, for instance, any subdomain of a domain.
Say you have also a blog accessible at blog.mysafeshop.com. You can grant access to your Search Engine from both www and blog by using a wildcard: *.mysafeshop.com.
If you have inner subdomains, you can repeat the pattern: *.*.mysafeshop.com.
If you use your Layer in different pages with multiple inner subdomains, you can match all of them with the double asterisk wildcard (**) like in: **.mysafeshop.com.
Blocked IPs
There is another option available for security configuration: Blocked IP's. This allows you to specify IPs or entire IP ranges using network notation to explicitly forbid access to your Search Engine.
This is useful to prevent bot attacks from public IP's. It will also allow you to easily stop any puntual attack from a specific IP if it ever happen.
Remember to review blocked IP's frequently because IP's in the internet change, so you may be blocking a valid IP at some time.
Bot Attacks
What are bot attacks? Bot attacks are an increasing number of visits to your website performed by robots, which are abnormally higher compared to a real person's visit. When it comes to humans, we’re talking about 5 to 10 page clicks, while a bot can produce hundreds or more visits in a short period of time.
Please note that not all bots are bad, especially those originating from larger search engines such as Google, which provides positive customer referrals. Those that come from smaller entities are the root cause of the problem since they are more frequent, poor in value, and because they are looking for rapid growth for their database. In sum, they are feeding from your data and are not returning any referrals.
If you would like to know how to prevent it, please check the Security Section of our FAQs.