Website data is rejected („origin“)

Area: Tracking snippet · Updated: 31 Oct 2026 · Auf Deutsch · All articles

Symptoms

  • Live-Prüfung › Domains gesehen shows „abgelehnt (Herkunft nicht erlaubt)“ for a host.
  • Open item: „Besuche von staging.example.com wurden abgelehnt (12×) – die Herkunft ist nicht erlaubt.“ or „https://staging.example.com ist nicht als Herkunft erlaubt – Besuche von dort werden abgelehnt.“
  • In the browser POST /v1/e answers 403 without a body; live signals (/v1/hb, /v1/l) answer 403 {\"error\":\"origin\"}, recordings (/v1/r) origin.
  • setup_verify_installation reports for „Adresse erlaubt“: „https://staging.example.com is not an allowed origin – the ingest answers POST /v1/e with 403 and stores nothing“.
  • The main domain counts, a subdomain, preview or staging site does not.

Cause

  • The address is missing from the project's allowed origins. X3 only accepts data from allowed origins so nobody can write numbers into your project.
  • Scheme or port differ: http:// instead of https://, or a port like :8080.
  • https://*.example.com allows subdomains only, not example.com itself.
  • A preview on a site-builder domain (e.g. a Vercel or Netlify preview) is never allowed automatically, because that domain belongs to many.
  • Until the update of 31 Oct 2026, „Tracking einstellen“ saved only the domain when adding an address, not the origin.

How to fix it

1. Look at the rejected addresses

  • In the dashboard: Einstellungen › Einbau & Status › Alle Einbau-Varianten, Proxy und Live-Prüfung › Live-Prüfung › Domains gesehen
  • With Claude (MCP): setup_status {"project":"my-shop"}

Open items with origin_rejected or origin_missing name the host. Since the update of 31 Oct 2026 rejected live signals (/v1/hb, /v1/l) and recordings (/v1/r) show there too, not only visits.

2. Look at the allowed origins

  • In the dashboard: Einstellungen › Einbau & Status › Erlaubte Herkünfte
  • With Claude (MCP): tracking_origins_get {"project":"my-shop"}
  • List and MCP tool exist since the update of 31 Oct 2026; before, the list was only in project_get under allowedOrigins.

The table can be sorted, filtered and its columns chosen. „Zählt als eigene Domain: nein“ means the origin is allowed but visits there are still dropped. Allow the address once more, X3 adds the domain too.

3. Allow an address

  • In the dashboard: Einstellungen › Einbau & Status › Erlaubte Herkünfte › Adresse erlauben › Erlauben
  • With Claude (MCP): tracking_origins_update {"project":"my-shop","add":[{"host":"staging.example.com"}],"dry_run":true}
  • Since the update of 31 Oct 2026.

An address the live check has seen already can also be allowed there with „Erlauben“ (for unknown hosts first „Ich bestätige, dass … zu mir gehört“ › Freigeben). Claude shows the dry-run preview first, then saves without dry_run. Every allowed address also counts as an own domain. Needs the role owner or admin; only allow addresses you own.

4. Allow every subdomain at once

  • In the dashboard: Einstellungen › Einbau & Status › Erlaubte Herkünfte › Adresse erlauben › Subdomains erlauben › Erlauben
  • With Claude (MCP): tracking_origins_update {"project":"my-shop","add":[{"host":"example.com","subdomains":true}],"dry_run":true}

Adds https://*.example.com and *.example.com; the address itself stays its own entry. For builder and hosting addresses (e.g. Webflow, Shopify or Vercel addresses) X3 refuses „every subdomain“ because other customers live there: allow only your exact address or use a preview domain under your own domain. X3 does not accept placeholders like example.com at all; the examples here are only examples.

5. Remove an old address

  • In the dashboard: Einstellungen › Einbau & Status › Erlaubte Herkünfte › Entfernen › Ja, entfernen
  • With Claude (MCP): tracking_origins_update {"project":"my-shop","remove":["https://old.example.com"],"dry_run":true}

Visits from there stop counting afterwards. The last origin cannot be removed.

6. Allow local tests

  • In the dashboard: Einstellungen › Erweitert › Adresse und Tests › Lokale Tests erlauben
  • With Claude (MCP): project_update_tracking_config {"project":"my-shop","patch":{"allowLocalhost":true}}

For development only: visits from localhost count too.

7. Check

  • In the dashboard: Live-Prüfung › Website jetzt prüfen
  • With Claude (MCP): setup_verify_installation {"project":"my-shop","url":"https://staging.example.com"}

How to tell it worked

  • Live-Prüfung › Domains gesehen shows „erlaubt ✓“ for the host.
  • setup_verify_installation reports „Adresse erlaubt“ as passed, new visits from there show under Live.