Installation security
Control where your tracking script is accepted, exclude internal traffic, and keep dynamic URLs readable.
Allowed hostnames
Your project domain and its subdomains are always accepted. Use allowed hostnames to also accept events from extra hosts (preview URLs, alternate domains). Unlisted foreign hosts are still rejected.
preview.vercel.appstaging.myapp.com*.mypreview.apppreview.vercel.appstaging.myapp.com*.mypreview.apppreview.vercel.apphostname
Allow exactly that host in addition to your project domain.
staging.myapp.comhostname
Allow one specific extra host.
*.mypreview.appwildcard
Allow that apex and all of its subdomains.
Project settings → Security. Your project domain always stays allowed.Blocked IPs
Use blocked IPs to exclude internal traffic, QA devices, office networks, or noisy monitors from your reports.
203.0.113.10198.51.100.0/24203.0.113.10198.51.100.0/24Blocked pages
Blocked pages prevent specific paths from being tracked. This is useful for admin areas, previews, or routes that should not appear in analytics.
/admin/dashboard/*/preview/*/admin/dashboard/*/preview/*Masked pages
Masked pages group dynamic paths into readable patterns so reports do not fill up with unique IDs.
/orders/*/users/*/projects/*/settings/orders/*/users/*/projects/*/settings/orders/123 and /orders/456 grouped as one report row.