# Hosts a site may legitimately load assets from. One per line; subdomains match.
# Read by devdmalw_host_is_benign() (scanner/obfuscation.php). Data, not code: this plugin
# never loads anything from them, it only stops flagging pages that do.
googleapis.com
gstatic.com
google.com
googletagmanager.com
google-analytics.com
gravatar.com
wp.com
wordpress.com
wordpress.org
w.org
jquery.com
cloudflare.com
cloudflareinsights.com
jsdelivr.net
unpkg.com
cdnjs.cloudflare.com
youtube.com
youtu.be
vimeo.com
twitter.com
x.com
facebook.com
facebook.net
instagram.com
linkedin.com
stripe.com
paypal.com
recaptcha.net
hcaptcha.com
fonts.googleapis.com
fonts.gstatic.com
devdome.com
# Embed and widget providers commonly placed in posts and widgets via iframe or script.
youtube-nocookie.com
calendly.com
typeform.com
open.spotify.com
w.soundcloud.com
fast.wistia.net
fast.wistia.com
loom.com
forms.gle
airtable.com
codepen.io
giphy.com
tiktok.com
embed.tawk.to
js.hs-scripts.com
