Add an allowlist of domains to a form. Submissions whose Origin/Referer isn't in the allowlist are rejected with a 403 — a simple, effective way to stop your endpoint being abused from other sites.
Domain restriction
Only accept submissions from your domains (Pro).