What you can publish

Every customer site is published on a subdomain of the same domain. Browsers judge safety at the domain level, so a single page that looks like a phishing page can put a red warning in front of every customer's visitors — not just yours. Forms that ask for the things below are exactly what browsers look for.

Forms must never ask for

• Passwords, passcodes or security questions
• PINs — ATM, banking, card or otherwise
• One-time codes: OTP, TAC, 2FA or verification codes
• Card numbers, CVV/CVC, or card expiry dates
• Bank login details, account or routing numbers, IBAN or SWIFT codes
• Crypto seed phrases, recovery phrases or private keys

A form asking for any of these is refused when you publish, whatever the field is called and whatever the rest of the page says.

Identity documents need approval

• Identity-document numbers: NRIC, MyKad, passport, social security

Regulated identity documents are refused on your free subdomain, because that domain's safety reputation is shared with every other customer. If your business genuinely needs them — an insurance broker quoting a policy, for example — connect your own custom domain and ask us to approve the site. Most businesses should collect these after the enquiry, not on a public form.

Good forms

• Ask for what you need in order to reply: name, email address, phone number, company, address.
• Ask about the visitor's own needs: budget, project scope, preferred date, party size, dietary requirements, existing cover.
• Use the field description to explain why you are asking for something.
• Keep the form on the topic of your own business.

Your site must never

• Present your site as an organisation you do not own or represent — a bank, government agency, courier, telco, utility, airline, marketplace or crypto exchange.
• Use another company's name or logo as though the site were theirs.
• Build a sign-in page, an "account verification" page, or a "pay a delivery fee", "claim your prize" or "tax refund" page.

What is fine

• Name brands you resell, payment methods you accept, or couriers you ship with — that is ordinary and allowed.
• Use your own business name, even when it happens to share a word with a well-known brand.

If your site is refused

We check every page when you publish it. If we get it wrong — it is your own business, and nothing on the page collects the things above — email [email protected] and a human will look at it. To report a site published through us that breaks these rules, see Report abuse.

The Sites is a product of NovaDyne Sdn Bhd, Petaling Jaya, Selangor, Malaysia. Questions: [email protected] · Terms · Privacy · Refunds · Report abuse