On this page8 sections
A website can stay public and still set a clear boundary for a particular converter. That boundary becomes enforceable when the converter checks it on its own server. A script pasted into a website has a different job: it can discourage some capture workflows inside a cooperative browser, but it cannot guarantee that public code will never be copied.
Deframer's site protection separates three layers. A verified registration blocks Deframer conversions, downloads and previews while active. An inline helper, included in the standard snippet, shows a recoverable notice when it detects specific design-capture markers. Optional Cloudflare setup adds a request gate under the site's own hosting account. Deframer controls its registry; the browser helper is best effort, and the Cloudflare rule covers only traffic routed through the configured hostnames.
Rendering requires delivery
To display a page, a visitor's browser receives HTML, styles, images and JavaScript. Moving a script inline changes how it arrives, but the browser still needs its contents to execute it. A converter can fetch public resources without executing the helper, or remove it before rendering the page.
This also means that hiding markup with CSS or changing what the page shows after load does not remove the underlying files. Screenshots capture pixels, while design-import tools may read layout and styles. A single page script cannot control all of those routes.
A blocked CDN is only one bypass
An externally hosted helper can be stopped by blocking its request. Inline installation removes that specific URL dependency, which is useful, but a determined capture tool can remove an inline script too.
For that reason, Deframer's protected-site registry is independent of the installed tag. The tag establishes control during setup. Once protection is active, removing the tag does not lift the server block. The owner pauses it from their dashboard.
Browser extensions have their own boundaries
Chrome content scripts normally run in isolated JavaScript worlds. They share access to the page's DOM, but do not share the page's JavaScript variables in the same way as ordinary scripts. Chrome's content-script documentation explains this separation.
A page may detect a visible toolbar or another public marker, but a tool need not expose that marker, and a new version may change it. Detecting a known marker is evidence that one pattern appeared. It is not proof that every capture tool has been blocked.
Deframer's optional helper therefore avoids broad browser-automation heuristics and global API changes. It watches a small set of known markers, shows a notice, and provides a recovery button. Compatibility is tested with representative fixtures; it is not certified coverage of every current vendor and version.
Why Netflix-style DRM does not protect page source
Encrypted Media Extensions provide an interface for encrypted media playback. They do not place a page's DOM, styles or JavaScript inside the media decryption system. Adding a video element or a DRM-related header cannot make ordinary HTML unreadable or guarantee a black screen in recordings.
The Screen Capture specification defines display-capture as permission for a document to initiate getDisplayMedia(). Disabling it does not stop another application from capturing that document.
Preventing anonymous source harvesting needs enforcement before delivery of HTML and assets, with restricted direct origins and alternate domains. A public Framer CDN remains a bypass around a proxy that guards only the homepage. An approved browser can still read the source it receives. Keeping the original DOM off the visitor's device requires a different delivery architecture, such as remote rendering, and displayed pixels still remain capturable.
What a Cloudflare gate changes
A WAF can challenge a request before the website returns HTML or an asset. Deframer's guided Cloudflare setup generates a Managed Challenge rule for the exact hostname and its www version, on all paths and methods. Filtering only HTML would leave same-host modules and asset URLs open. Cloudflare itself evaluates challenge clearance; checking whether a request contains a cookie named cf_clearance is not equivalent. See Cloudflare's custom rules and clearance documentation.
This is a manual configuration in the owner's Cloudflare account. Deframer does not collect account credentials, write DNS records or deploy the rule automatically. Framer's Cloudflare proxy guide describes its supported hosting setup. A proxy should preserve Framer's managed HTML and scripts rather than attempting to hide modules by rewriting its React root.
The owner proves DNS control using a site-specific TXT record. Pending codes expire after 24 hours. Verified codes stay stable, but activation, resume and coverage checks resolve the record again. New DNS-only proof authorizes hostname coverage in Deframer; it cannot claim someone else's public Framer bundle or establish project-wide aliases. A previously registered Framer project needs fresh trusted HTML proof before its paused project-wide block can resume.
Routing a custom domain through Cloudflare does not restrict the original Framer hostname or its separate public CDN. If a converter already knows a public module URL, that request can go directly to the CDN. Stronger coverage requires restrictions at every origin that serves those bytes. Challenge-passing browsers still receive readable content, and challenges can affect legitimate visitors, forms, APIs, webhooks and crawlers. Any exception needs review because it also allows access through that route.
Coverage checks are observations
The dashboard's free check samples anonymous requests to the homepage, supplied origins and asset URLs, and may discover a Framer main module. It records URLs, outcomes and a timestamp. It does not explore every route or certify all converter workflows.
Challenge observed requires Cloudflare challenge evidence. An ordinary 401 or 403 is a Denied response, which can have other causes. A timeout, missing resource or unavailable origin does not establish a block. Bypass found identifies a public response in the sample; Sample checked means no bypass appeared in those listed checks. Neither result means that unlisted origins are sealed or that a future publish will keep the same coverage.
DNS verification proves control of the hostname. Finding the helper proves static script presence. Observing a challenge proves what one anonymous request received. Keeping those statuses separate makes it possible to act on a missing control without claiming more than the check established.
Enforce the policy at every access point
A server block needs to cover more than the button that starts a new conversion. A project may already exist in a recent-conversion cache. A user may already have paid for its download. A browser may still hold a preview cookie. Admin tools may have their own retry and download routes.
Deframer checks active registrations when admitting work and serving output. Its direct-download option follows the same protection rule. The owner follows it too and can pause protection to convert their own site. A trusted Framer project identity covers aliases of the same site so changing its published address does not provide an ordinary Deframer bypass.
This cannot recall bytes that have already left the service. Previously downloaded files, responses already in flight and previously issued download links are outside that boundary. An already-open preview can still show content it has loaded.
Choose protection with the limits in view
Deframer protection costs 10 credits once per verified site, with free setup, free ownership checks and free pause/resume for that registration. Guided Cloudflare configuration and coverage checks are also free; Cloudflare and hosting charges are separate. The payment activates Deframer's registry, not the customer's WAF rule. Pausing the registry does not turn off that external rule.
The registry makes a concrete commitment about Deframer's behavior. A correctly configured edge gate can make anonymous access harder, within its actual hostname and origin coverage. Neither promises control over every third-party service, self-hosted tool, screenshot or approved browser.
Read the setup and coverage guide before activating, or see how to protect a site for a walkthrough. Staging registrations affect staging only; production has its own registry.