# Whitelist to allow onebox only with https domains?

**URL:** <https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820>\
**Category:** Product Support\
**Created:** [29 באוקטובר,‏ 2018,‏ 7:01pm UTC](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820 "2018-10-29T19:01:12Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)\
**Post date:** [29 באוקטובר,‏ 2018,‏ 8:27pm UTC](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820/5 "2018-10-29T20:27:30Z")

</div>

You’re asking about oneboxing, but as I said:

> [@Stephen](#):
>
> Image links aren’t oneboxed at all

If a user directly links to an image from one of the services you mentioned:

 ![](https://global.discourse-cdn.com/meta/original/3X/d/e/deee6fbb806a63ab7f22da4c1de37721dea57b93.jpeg)

There is no onebox.

Plus, Oneboxes are cached for 24 hours, I’ve not seen clarification either way as to whether unchecking that box disables the caching of the image asset explicitly, I’ve only seen it employed for image embeds. I guess it’s something you can go off and test though.

---

_[View the full topic](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820)._