# Whitelist to allow onebox only with https domains?

**URL:** <https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820>\
**Category:** Product Support\
**Created:** [29 באוקטובר,‏ 2018,‏ 7:01pm UTC](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820 "2018-10-29T19:01:12Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![keith1](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/keith1/32/178982_2.png) [@keith1](https://meta.discourse.org/u/keith1)\
**Post date:** [29 באוקטובר,‏ 2018,‏ 7:01pm UTC](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820/1 "2018-10-29T19:01:12Z")

</div>

I’m curious if there’s a way to whitelist only from https domains?

_The problem:_  
I’m using Discourse for an extremely visual community, and have a ton of hesitations about my disk usage if I enable self-hosting of images (I’d rather let hosting sites solve storage and CDN problems for me). Allowing users to post content from other sites has been going well, with the exception of http vs https links. Is there an easy way I can prevent onebox (and warn users) from accepting links from non-https domains?

---

_[View the full topic](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820)._