[frankforpresident]

Referrer blocking accepts single-label wildcard entries such as *.example.com.

Summary

• New "Matching rules" section on the referrer blocking page: exact hosts and ports (ports only with localhost), local development, wildcards (exactly one subdomain level, the bare domain not included, shared suffixes), wildcard placement, case-insensitive matching, native apps and the embedding page's Referrer-Policy.
• A caution that referrer blocking deters embedding but is not access control, pointing to token-based security.
• The intro describes the list as an allow-list, and the API example uses a wildcard.

Merge gate

Draft until the streaming API change (wildcard validation) and the dashboard change are live in production: a merge to main deploys the site immediately, and until the API ships, a wildcard entry is rejected with a 400. The generated API reference picks up the new allowedDomains description from the production swagger once the API is live.

Follow-up: theolive/assets/img/referrer-blocking.png still shows the old dashboard subtitle ("Add domains to allow or deny."); re-capture it once the dashboard change is live.

Test plan

• npx prettier --check and npx mdxlint --frail on the page
• Every claim checked against the API validator and the edge matchers
• Rendered page reviewed in the preview build

[theoplayer-bot]

Documentation preview
🚀 View preview at https://docs-preview.optiview.dolby.com/pr-932/
Deployed from commit 906fbe1 at 2026-10-21 20:34 UTC.