# Egress domains

Forge apps can only reach domains that have been declared, which is a real security property rather than an inconvenience. If your diagrams need to load an image or a source file from your own server, you approve that domain yourself.

Approving a domain means the browser fetches it directly, so it is worth understanding what that implies before you add one.

---

## When you would change this

* Diagrams that embed images hosted on your own servers.
* Sources pulled from an internal repository or documentation host.
* A self-hosted renderer, which needs its own domain approved.

---

## What you can set

| **Setting** | **What it does**                                                |
| ----------- | --------------------------------------------------------------- |
| Where       | Site settings, in the diagram administration area.              |
| Who         | A Confluence administrator.                                     |
| Effect      | The browser may fetch from that domain when rendering diagrams. |
| Scope       | The domains you add, and nothing else.                          |

---

## A few things that catch people out

* Approving a domain means the reader's browser connects to it directly, so that host sees your users' requests.
* Only add domains you control or trust. This is a security decision, not a convenience setting.
* The security implications are set out properly in [Security and privacy](https://help.gocapable.com/diagrams/security-and-privacy.html).

---

## Related

[Self-hosted diagram rendererRendering inside your own network.](https://help.gocapable.com/diagrams/self-hosted-diagram-renderer.html)

[Turn off AI featuresOne switch, three surfaces.](https://help.gocapable.com/diagrams/turn-off-ai-features.html)

[ExamplesWorking diagrams you can copy.](https://help.gocapable.com/diagrams/examples.html)

---

_Set it once, in the right place._