Skip to content

Sitelock

Sitelock helps prevent your HTML5 game from being copied and hosted on unauthorized websites.

Protecting HTML5 games

To prevent your game from being stolen by other websites, check whether the game is running on crazygames.* domains. This is an example domain that should support loading the game: https://cubes-2048-io.game-files.crazygames.com/cubes-2048-io/13/index.html

Your can use this function to ensure your game runs on valid CrazyGames domains.

function isCrazyGames() {
    const hostname = window.location.hostname;
    const parts = hostname.split(".");
    const idx = parts.indexOf("crazygames");
    return idx !== -1 && idx >= parts.length - 3;
}

If this check fails, you can show a message such as "Available only on CrazyGames" or render a blank screen.

To improve sitelock robustness, you can obfuscate relevant parts of your game code with a tool like obfuscator.io.

Protecting iframe games

To prevent iframe embedding, configure the CSP header: Content-Security-Policy: frame-ancestors [...]

If you submit your game as an iframe game, keep in mind that CrazyGames has multiple regional domains (for example www.crazygames.no, www.1001juegos.com, www.crazygames.fr). You must whitelist all supported CrazyGames domains:

// General
*.crazygames.com
crazygames.*   // * can be a TLD consisting of 1 or 2 parts like .fr or .com.br

// Exhaustive list
www.crazygames.com
de.crazygames.com
it.crazygames.com
vn.crazygames.com
gr.crazygames.com
ar.crazygames.com
th.crazygames.com

www.crazygames.fr
www.crazygames.co.id
www.crazygames.cz
www.crazygames.dk
www.crazygames.hu
www.crazygames.nl
www.crazygames.no
www.crazygames.pl
www.crazygames.com.br
www.crazygames.ro
www.crazygames.fi
www.crazygames.se
www.crazygames.ru
www.crazygames.com.ua
www.crazygames.at
www.crazygames.jp
www.crazygames.pt
www.crazygames.vn
www.crazygames.com.vn
www.crazygames.co.kr

// video ads run on
games.crazygames.com

// our iOS and Android apps, mind the scheme on iOS
https://app.crazygames.com
capacitor://app.crazygames.com

//deprecated domains (no longer need whitelisting)
www.1001juegos.com
tr.crazygames.com

Sitelock in the CrazyGames App

Players also play your game in our iOS and Android apps. Both are native WebViews that run the CrazyGames portal from a local copy of the site, so the page embedding your game is not www.crazygames.com there:

App Origin of the page embedding your game
iOS capacitor://app.crazygames.com
Android https://app.crazygames.com

iOS reserves the https scheme for the network and does not let a WebView serve local content over it, which is why the origin of our iOS app uses the capacitor scheme.

A bare host in frame-ancestors means https only

Entries such as *.crazygames.com inherit the scheme of the document that served the policy, so in a policy delivered over https they allow https ancestors only. The host of our iOS app matches, its scheme does not, and WebKit refuses to render your game. Players see a white screen: no JavaScript error is thrown, the block is only reported as a CSP violation in the console.

This policy works on the web and in the Android app, but shows a white screen in the iOS app:

Content-Security-Policy: frame-ancestors 'self' *.crazygames.com;

Listing the app origins explicitly fixes it:

Content-Security-Policy: frame-ancestors 'self' *.crazygames.com https://app.crazygames.com capacitor://app.crazygames.com;

Two more things to keep in mind:

  • frame-ancestors is checked against every ancestor of your game, not only its direct parent. In the apps, your game is embedded by our game frame on games.crazygames.com, which is itself embedded by the app, so both origins have to be allowed.
  • The isCrazyGames check above keeps working in the apps, but if your sitelock checks the embedder (document.referrer, location.ancestorOrigins) instead of its own location, apply the same rule there: compare the host and don't require the https scheme.
Ask AI