Domains and staging

Every site in ConsentLayer has a list of domains. The banner runs only on the hosts in that list. On any other host it does nothing: no banner, no script blocking, no consent records.

This keeps each site's tracker rules and consent log on that site. A snippet copied to another website does not load the first site's rules there, and does not mix two sites in one consent log.

The banner runs on a page when the page's host is one of these:

a domain on the site's list, for example example.com;
a subdomain of a domain on the list, for example shop.example.com or staging.example.com when example.com is listed;
localhost, any *.localhost host, 127.0.0.1 or [::1], so local development always works.

A preview host must itself be on the list. Listing my-app.vercel.app allows that host only. Being on vercel.app is not enough, because anyone can deploy to *.vercel.app.

Shopify sites are different: the banner always runs on the shop's storefront.

Which domains are free

Your plan limits the number of production domains per site (Free: 1; Solo and higher: unlimited). Staging and preview domains do not count toward that limit, on every plan. A domain is staging when it is one of these:

a subdomain of a production domain the site already has, for example staging.example.com on a site with example.com. The www host is not staging: www.example.com is the live site. example.com and www.example.com count as one domain together;
localhost, *.localhost, 127.0.0.1 or [::1];
an exact host under one of these preview suffixes:

Suffix	Example
`vercel.app`	`my-app-git-main-team.vercel.app`
`netlify.app`	`deploy-preview-42--my-site.netlify.app`
`pages.dev`	`abc123.my-project.pages.dev`
`lovable.app`	`my-app.lovable.app`
`webflow.io`	`my-site.webflow.io`
`framer.website`	`my-site.framer.website`
`framer.photos`	`my-site.framer.photos`
`framer.media`	`my-site.framer.media`
`framer.wiki`	`my-site.framer.wiki`

In Site → Settings → Domains, a free domain shows a Staging label.

A staging or preview domain shares its site's banner, categories and consent log. If the domain is a separate website and not a copy, set it up as its own site.

Sites per plan

Plan	Sites	Production domains per site
Free	1	1
Solo	1	Unlimited
Studio	10	Unlimited
Agency	30	Unlimited

Solo adds unlimited domains on its one site, not more sites. A second site needs Studio. See pricing.

Before you create a second site, check whether the new host is a copy of a site you already have. If it is, add it to that site as a domain. It uses no new site slot.

What happens on a host that is not on the list

The banner script loads, then stops at once. It shows no banner, holds no scripts and records no consent. Trackers on that page run as if ConsentLayer were not installed.

The browser console shows this warning:

[ConsentLayer] The banner is off on "<host>" because this domain is not on the site's list. Add it in ConsentLayer → Site settings → Domains.

The banner also reports the blocked host to ConsentLayer, at most once per host per browser every 24 hours. It sends the host name only, never the page path, query or referrer.

Find a blocked host

ConsentLayer keeps the hosts that reported a blocked banner in the last 30 days, and shows them in three places.

Site dashboard. Each blocked host gets a notice (up to 3; the rest are counted with a link to Domains):

Your banner is blocked on <host> because it is not in your domain list.

The notice says when the host was last seen. Click Add domain to add the host to the site. If the host is not yours, dismiss it in Domains.

Site → Settings → Domains. The Blocked recently list shows each blocked host with when it was last seen and how many reports it sent. Click Add to put the host on the site's list, or Dismiss to hide it. A dismissed host stays hidden, even if it reports again.

Installation check. When you check the installation, the result names each blocked host. It also reports domain_not_listed when the site's domain redirects to a host that is not on the list, for example example.com to example.co.uk. Add the host the domain redirects to, then check again.

In the browser. Open the page, open the developer tools (F12, or Cmd+Option+J on a Mac), and look in the Console tab for the warning above. The quoted host is the one to add.

Only add hosts that are yours. A host in the list can be a copy of your site that someone else runs with your snippet.

With an agent

check_installation returns blocked_hosts (each with host, last_seen and hits) and a next step. list_sites and get_started return blocked_hosts on each site that has one. The next step tells the agent to ask you whether each host is yours, and to call add_site_domain only for the hosts you confirm. For domain_not_listed, the host is the one your own domain redirects to, so the agent adds it with add_site_domain and checks again.

Add a domain

In the dashboard: click Add domain on the site dashboard notice, or Add in the Blocked recently list. To add a host that is not listed there, open Site → Settings → Domains (https://app.consentlayer.com/sites/<site-id>/settings), type the host without https:// or a path, and add it. The banner is rebuilt with the new domain. Reload the page to see it.

With an agent: ask your agent, for example:

"Add staging.example.com to my example.com site in ConsentLayer."

The agent calls add_site_domain. If the domain is production and the site is at its plan's domain limit, the agent gets PLAN_LIMIT_REACHED with an upgrade link and tells you. See AI agent integration.

With the API: POST /sites/{id}/domains with { "domain": "staging.example.com" }. The response includes kind: "production" or "staging".