# Whitelist to allow onebox only with https domains?

**URL:** <https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820>\
**Category:** Product Support\
**Created:** [29 באוקטובר,‏ 2018,‏ 7:01pm UTC](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820 "2018-10-29T19:01:12Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![keith1](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/keith1/32/178982_2.png) [@keith1](https://meta.discourse.org/u/keith1)\
**Post date:** [29 באוקטובר,‏ 2018,‏ 8:40pm UTC](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820/6 "2018-10-29T20:40:39Z")

</div>

Ah, thank you so much for the clarification.I was mis-understanding the process used for displaying the images pasted as urls into a message (I’d assumed this was still a part of the onebox process)

So If I understand this correctly now, you’re saying that anytime I paste an image url from a site (say imgur), it pulls it and self hosts on my server (i.e. not a hotlink)?

What I’m trying to avoid are mixed content warnings/error messages from security audits of the site - currently users are pasting links without the http **s** , even though their domain does have a valid ssl cert. I assumed that these were hotlinking, and thus causing the mixed content error messages

---

_[View the full topic](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820)._