1. Add your published homepage
In Dashboard → Protect sites, enter the HTTPS address visitors use, such as https://example.com/. Setup is free. We use the homepage at that origin; pasted paths and query strings are removed. The standard check needs public HTML with your tag in its head. For a custom domain behind a firewall or password wall, the Cloudflare setup offers DNS ownership verification instead.
Coverage includes the exact hostname and its www version. Other subdomains are separate: protecting one customer’s hosted subdomain cannot block the other customers. A trusted HTML response from Framer can establish project coverage, including alternate domains and later publishes. New DNS-only registrations cover the hostname and www; DNS does not establish a trusted Framer project identity. Manage a covered alias through its existing registration.
2. Install the tag and publish
For HTML verification, copy your unique code from the dashboard. In Framer, open Site settings → Custom code → End of <head>, paste it and publish. On another platform, place the tag in your homepage’s HTML head using its settings, template or layout.
<meta name="deframer-protection" content="YOUR_CODE_FROM_THE_DASHBOARD">
The public tag proves you can publish the site. It is different from the deframer-verification tag used for 1-credit downloads. Do not copy another site’s protection code.
“Include browser capture deterrent” is enabled by default. Copy the complete snippet, including its script. Replace the previous code rather than stacking copies. Existing sites must replace the old snippet and republish to receive an update. The helper is inline, with no CDN call, license lookup or visitor telemetry. It leaves browser APIs, normal text selection and right-click unchanged. If your Content Security Policy forbids inline scripts, use your platform’s nonce or hash workflow, or install only the tag. Do not weaken your policy just for this helper.
When necessary, turn the deterrent off to copy only the ownership tag. This still enables the Deframer server block after verification and activation.
3. Check ownership for free
Click “Check published site.” We fetch fresh HTML through the same public-network safeguards as the converter, follow validated redirects, and require your exact tag in the head of the same host’s HTTPS homepage. Body text, comments, embedded examples and a redirect to a different website do not count. This step spends no credits.
If the tag is missing, publish again, confirm it is in the homepage’s head, and wait for your host’s cache to update. A redirect to a language path or another domain will fail; use a hostname that serves its own homepage. For proxy-hosted Framer sites, exact-host protection works, but bundle-wide coverage requires a direct, trusted Framer response.
The dashboard reports the browser helper separately. “Found in HTML” means the current version’s inline source was found on that homepage; it does not prove the script executed, that your Content Security Policy permits it, that every page has it, or that any converter was blocked. “Not found” and “Update needed” are instructions to replace the complete snippet and republish. “Check installation · free” repeats the ownership and static installation check without spending credits.
Optional: configure Cloudflare before delivery
Choose “Set up Cloudflare edge protection” on your site. This guided setup, DNS verification and coverage checks are free. They are separate from the one-time 10-credit Deframer activation. You need a custom domain whose DNS you control and your own Cloudflare account. A hosted .framer.website or .framer.app subdomain cannot publish your TXT record.
- Add the exact TXT record shown in the dashboard at your DNS provider, then choose “Verify DNS · free.” Unverified setup codes expire after 24 hours; renew setup if needed. Once verified, keep that record published. DNS activation, resume and every coverage check resolve it again; a previous verification timestamp is not current proof.
- Route the registered hostname and its www version through Cloudflare using proxied DNS. For Framer, follow its supported Cloudflare proxy setup, including hosting requirements, canonical domain settings and disabling Rocket Loader. Deframer does not create DNS records, deploy a Worker, change firewall rules or collect Cloudflare credentials for you.
- In Cloudflare, create a WAF custom rule using the generated expression and select Managed Challenge. It matches only your registered hostname and www, on all paths and all HTTP methods, including same-host module and asset requests. Copy the generated JSON if you manage configuration through tooling. Review the Cloudflare custom-rule documentation.
(http.host in {"example.com" "www.example.com"})
A challenge can affect visitors, forms, APIs, webhooks, crawlers and embedded pages. Test your normal browsing and integrations before relying on the rule. Review exceptions individually: exempting a route also reopens access to it. Cloudflare validates challenge clearance itself; a cookie name or client-supplied header is not authorization. See challenge compatibility limits.
In “Check coverage,” add up to four origin or alternate site URLs and four asset URLs, including your public Framer origin and external module CDN. Use HTTPS URLs without query strings or credentials. The bounded anonymous sample checks the homepage and supplied URLs, and may discover a Framer main module. “Challenge observed” means the sampled response carried Cloudflare challenge evidence. An ordinary 401 or 403 is reported as “Denied”; it does not confirm a Cloudflare rule. “Unavailable” is not evidence of protection.
“Bypass found” identifies a public response in that sample. “Sample checked” means no bypass was found in the listed checks, not that all origins, modules or converter workflows are protected. Review the tested URLs and time, then recheck after publishing or changing hosting. An owner’s Cloudflare zone cannot restrict framerusercontent.com or a public Framer origin. Those remain bypasses unless their own hosting separately restricts access. An approved browser still receives readable content.
DNS proof does not replace the trusted Framer identity check for an existing project-wide registration. Resuming that paused registration needs fresh published-tag proof delivered by Framer. If your proxy prevents that check, contact support; DNS alone cannot reactivate its old project binding.
Why this cannot add Netflix-style recording protection
Browser DRM interfaces protect encrypted media playback, not arbitrary HTML, CSS or JavaScript. A normal page cannot use them to make its DOM or modules unreadable, or reliably stop screen recording. The W3C Encrypted Media Extensions specification defines that media-only scope.
A “display-capture” Permissions Policy controls whether this page can initiate the Screen Capture API; it does not stop another application from capturing the page. See the Screen Capture specification.
Stronger prevention of anonymous source harvesting needs request enforcement before HTML and assets are delivered, with restricted origins and alternate domains. Framer supports reverse proxy hosting, but a public origin or separate asset CDN remains a bypass. An approved browser can still read the code it receives. This custom-code installation alone does not configure that hosting layer. The optional Cloudflare workflow guides your own configuration and samples its coverage; it does not certify that every delivery route is restricted.
4. Activate for 10 credits, once
Read the limits, confirm you control the site and accept the one-time charge, then click “Use 10 credits & activate.” We check ownership again before charging, using the published tag or a fresh DNS lookup for the DNS setup. Failed proof, insufficient balance or a conflicting registration uses no credits. Retried or simultaneous activation requests charge once. This payment activates Deframer’s registry; it does not enable or pay for a Cloudflare rule or hosting plan. An existing project-wide registration still needs trusted Framer HTML proof to resume its paused block.
Your registration stays on your account. There is no subscription or recurring credit charge. Pausing and resuming that registration are free; resuming requires another ownership check. The registered hostname cannot be switched to a different site. Contact us about a domain transfer, a changed Framer project identity or an ownership dispute.
Coverage & limits
- Cloudflare is a separate gate: your rule covers traffic routed through the configured hostnames. Direct origins, alternate domains and external CDNs require their own restrictions. A sampled challenge, denial or clean result is not universal converter coverage.
- Enforced in Deframer: new conversions, recent-conversion reuse, downloads of cached projects and new preview requests are blocked while active. Verified downloads, 10-credit direct downloads, admin retries and the owner’s account follow the same rule.
- Independent of your helper: disabling JavaScript, removing the tag or blocking a CDN URL does not remove the server registration. Pause it in your dashboard to lift Deframer’s block.
- Optional helper: watches a small set of known design-capture DOM and JavaScript markers and shows a recoverable notice. Detection can miss tools or produce false positives. Coverage has not been certified against every current vendor/version. Test your normal pages, forms, navigation and animations after installation. “Show page” dismisses the notice for that page.
- Public files stay public: this does not hide source, module requests, styles, images or screenshots from a browser. Extensions, third-party converters and self-hosted tools can ignore the registry or remove the helper. It cannot make a public website uncopyable.
- Prior access: previously downloaded files, in-flight responses and already-issued download links cannot be recalled. Requests made after activation are checked; an already-open preview may still show content it has loaded.
Pause, resume or remove the helper
Choose your site and click “Pause protection.” Confirming allows Deframer conversions, previews and downloads again, including existing cached projects. The optional helper remains on the website until you remove its script and publish. Your Cloudflare rule also stays enabled; disable that specific rule in Cloudflare to pause its challenge. Save existing DNS settings before changing them so you can restore them if needed.
To resume, keep or republish the appropriate tag or DNS record, check ownership and resume for free. Existing project-wide registrations require the trusted Framer HTML check. Unpaid drafts can be removed; paid registrations remain available so you keep the one-time price. For ownership transfers and account-data requests, contact support.
Staging and production have separate registries. A staging registration blocks only the staging service; production protection must be activated in your production dashboard.