Skip to content

Sitelock

Sitelock helps prevent your HTML5 game from being copied and hosted on unauthorized websites.

Protecting HTML5 games

To prevent your game from being stolen by other websites, check whether the game is running on a crazygames.com domain. This is an example domain that should support loading the game: https://cubes-2048-io.game-files.crazygames.com/cubes-2048-io/13/index.html

Your can use this function to ensure your game runs on valid CrazyGames domains.

function isCrazyGames() {
    const hostname = window.location.hostname;
    return hostname === "crazygames.com" || hostname.endsWith(".crazygames.com");
}

If this check fails, you can show a message such as "Available only on CrazyGames" or render a blank screen.

This check also works in our iOS and Android apps. If your sitelock checks the embedder (document.referrer, location.ancestorOrigins) instead of its own location, compare only the host: in our iOS app, the scheme of the embedding page is capacitor, not https.

To improve sitelock robustness, you can obfuscate relevant parts of your game code with a tool like obfuscator.io.

Protecting iframe games

To prevent iframe embedding, configure the CSP header:

Content-Security-Policy: frame-ancestors 'self' *.crazygames.com capacitor://*.crazygames.com;

If you submit your game as an iframe game, keep in mind that your game is embedded from more than one CrazyGames origin. This policy allows all of them: *.crazygames.com matches subdomains at any depth, which covers the website and our Android app, and capacitor://*.crazygames.com covers our iOS app, which runs on capacitor://app.crazygames.com. Keep the wildcard, because the app can also run on subdomains.

Don't leave out the capacitor entry

A bare host such as *.crazygames.com inherits the scheme of the document that served the policy, so it allows https ancestors only. Without capacitor://*.crazygames.com, your game works on the web and in the Android app, but shows a white screen in the iOS app: no JavaScript error is thrown, the block is only reported as a CSP violation in the console.

frame-ancestors is checked against every ancestor of your game, not only its direct parent. For example, in the apps your game is embedded by our game frame on games.crazygames.com, which is itself embedded by the app, so both origins have to be allowed.

Ask AI