On this page5 sections
Site protection lets a website owner ask Deframer to leave their site alone. Add the site, verify with a published tag or your custom domain's DNS, and activate protection for 10 credits once per verified site. While active, Deframer refuses new conversions, cached downloads and preview requests for that site. The block applies to direct downloads and the owner's account too.
The protection registry lives on Deframer's server. Removing a script, disabling JavaScript or blocking a CDN URL does not remove that registration. The standard snippet includes an inline helper that can deter some browser design-capture tools. Optional Cloudflare setup helps you challenge requests before your custom domain serves content. Each layer has its own coverage; none makes a public website uncopyable.
Start with proof, not payment
Open Dashboard → Protect sites and add the HTTPS homepage you control. Adding it creates an unpaid setup entry. It reserves no ownership rights against another user and spends no credits.
For the standard HTML check, copy the code shown for that site. In Framer, go to Site settings → Custom code → End of <head>, paste the code, and publish. On another platform, use its head-code setting or homepage template. The tag belongs in the published homepage's head, not a blog post, comment or body embed. A custom domain behind a challenge can use the DNS workflow below instead.
Click Check published site. Deframer fetches fresh public HTML and looks for your exact protection tag. A redirect to a different domain cannot prove ownership. If the tag is not found, check the placement, publish again and allow your host's cache to update. No credits are used for this check.
The protection tag is different from the personal verification tag used for 1-credit project downloads. Protection is a separate product, and ownership verification is always required before its first activation.
Add Cloudflare protection with DNS proof
Choose Set up Cloudflare edge protection on a site to use a custom domain whose DNS you control. A hosted .framer.website or .framer.app subdomain needs a custom domain first. Guided setup, DNS verification and coverage checks spend no credits; Cloudflare and hosting charges are separate.
Publish the exact TXT record shown in the dashboard, then select Verify DNS · free. This proves hostname control even when a challenge or password wall prevents Deframer from reading the homepage. An unverified code expires after 24 hours; renew setup to get a new one. After verification the code stays stable. Keep it published: DNS activation, resume and every coverage check perform a new lookup rather than trusting the earlier timestamp.
Next, configure proxied DNS in your own Cloudflare account. Framer owners should follow its supported Cloudflare proxy setup, including hosting eligibility and disabling Rocket Loader. Deframer does not collect Cloudflare credentials, deploy a Worker or change your DNS and WAF rules automatically.
The dashboard generates a WAF custom-rule configuration for Managed Challenge. It matches the exact registered hostname and its www version on all paths and all HTTP methods, including same-host modules and assets. Apply that specific rule in Cloudflare. Visitors may see a challenge; test forms, navigation, APIs, webhooks and search traffic. Exceptions reopen access to the exempted routes. Cloudflare validates clearance; the presence of a cookie alone is not authorization.
Use Check coverage · free to sample the homepage, up to four origins or alternate URLs, and up to four asset URLs. Include your public Framer origin and external CDN module URLs. The anonymous checks are bounded, with public-network safeguards; they accept HTTPS URLs without query strings or credentials. A Framer main module may also be discovered from fetched HTML.
Challenge observed means the sampled response carried Cloudflare challenge evidence. An ordinary 401 or 403 is Denied, and an unavailable URL does not prove protection. Bypass found reports a public response in the sample. Sample checked means no bypass was found in those listed checks, not that every module, origin or converter is blocked. Review the URLs and timestamp, then repeat after a publish or hosting change.
A Cloudflare rule for your custom domain cannot restrict framerusercontent.com, a public Framer origin, or another hostname outside its scope. Those need their own hosting restrictions. An approved browser can still read the content it receives. This is request filtering, not Netflix-style DRM or recording prevention.
Activate once, manage freely
Review the coverage and limits, confirm you control the site, then choose Use 10 credits & activate. The server checks the published tag or current DNS record again before charging. Repeated requests do not charge twice. Insufficient credits, failed proof or a conflicting registration leaves your balance unchanged. This payment enables Deframer's registry; your Cloudflare configuration is separate.
A registration covers the exact hostname and its www version. It does not claim every subdomain. New DNS-only registrations have that hostname coverage; DNS cannot establish a trusted Framer project identity. When Framer itself delivers the verified HTML page, the trusted project identity can also cover that project's alternate domains and later publishes. An alias of that project is managed through the original registration rather than another purchase. Resuming paused project-wide protection requires fresh published-tag proof delivered by Framer; DNS alone cannot reactivate an old project binding after a domain change.
Protection blocks everyone in Deframer, including you. If you want to move your own site, pause protection first. Pausing and resuming the same paid registration are free; resuming checks ownership again. Paid registrations stay on your account so you retain that one-time price. Contact support for a domain transfer or a different Framer project on the registered domain.
Pausing Deframer does not disable your Cloudflare rule. To stop its challenge, disable that specific rule in Cloudflare and preserve other security rules. Save your previous DNS records before making changes so you can restore them if needed.
The included browser helper
Include browser capture deterrent is enabled by default. Copy the complete installation code, including the inline script beside the tag. Existing installations need their old snippet replaced and the site republished to receive an update. There is no external CDN dependency, license request or visitor telemetry.
The helper watches a small set of known design-capture markers. When one appears, it shows a notice asking the visitor to respect the owner's work. A Show page button restores normal viewing. The helper does not overwrite browser APIs or block ordinary text selection and right-click. It does not treat every automated browser as an attacker.
Detection is best effort. Tools change, some use isolated extension contexts, and false positives are possible. Test navigation, forms and animations on your site after publishing. If your Content Security Policy does not allow the script, turn the deterrent off to copy only the meta tag, or use your platform's nonce or hash workflow. The server registration still works without the helper.
The dashboard checks helper presence separately from ownership and the Deframer block. Found in HTML confirms the expected inline source is on the checked homepage; it does not prove execution, compatibility with the page's security policy, other-page coverage, or capture prevention. Use Check installation · free to repeat that check. A missing or older helper needs a fresh snippet and republish.
What remains public
A browser must receive enough information to display a public site. Its HTML, styles, images and scripts remain accessible. A third-party converter, extension, screenshot tool or self-hosted copy can ignore the registry and remove the helper. Files already downloaded, in-flight responses and previously issued download links cannot be recalled.
Staging and production registrations are separate. A staging test blocks only the staging service; activate protection in the production dashboard to block production Deframer conversions.
Use the site protection guide for the complete workflow and troubleshooting, or open Protect sites to start with free setup.