Squarespace站点阻止第三方域名跳转的方法及脚本咨询

Great question—dealing with unauthorized domain forwarding to a Squarespace site is a super common frustration, but there are solid fixes you can implement right away. Let’s tackle both your concerns:

1. Blocking Third-Party Domain Redirects & Using a Script #

You can absolutely use a custom JavaScript script to block or redirect traffic coming from unauthorized domains. Here’s how it works:

Squarespace lets you inject custom code into your site via its built-in Code Injection tool. The core idea is to check the hostname of the current visitor’s URL—if it doesn’t match your official domain, you can either redirect them to your legitimate site or block access entirely.

Step-by-Step Script Implementation #

1. Go to your Squarespace dashboard → Settings → Advanced → Code Injection.
2. Paste this script into the Header section (this ensures it runs before the page loads):

// Replace with your official domain (no http/https prefix)
const officialDomain = "myclientdomain.com";

// Check if the current domain isn't your official one
if (window.location.hostname !== officialDomain) {
  // Option 1: Redirect to your official site (preserves the page path)
  window.location.href = `https://${officialDomain}${window.location.pathname}`;
  
  // Option 2: Replace the page with an access denied message (comment out Option 1 if using this)
  // document.body.innerHTML = `
  //   <div style="text-align:center; padding:50px; font-family:sans-serif;">
  //     <h1>Access Denied</h1>
  //     <p>This domain is not authorized to link to our site. Please visit <a href="https://${officialDomain}">our official website</a>.</p>
  //   </div>
  // `;
}

3. Save your changes, and test it out (you can use your computer’s hosts file to simulate visiting from an unauthorized domain if needed).

2. Neutralizing unwanteddomain.com’s Forwarding #

Since you don’t control the unwanteddomain.com settings, you can’t directly disable its forwarding to your client’s site. But the script above will make that forwarding effectively useless:

• When someone visits unwanteddomain.com, it forwards to your client’s Squarespace site.
• The script detects that the hostname isn’t myclientdomain.com and immediately redirects the visitor to the official domain.
• Users will barely notice the unwanted domain—they’ll land directly on your client’s legitimate site, rendering the malicious forwarding irrelevant.

Extra Tips to Strengthen Your Defense #

• Register similar domains: Encourage your client to register typos or similar domain names to prevent future hijacking attempts.
• Report to the domain registrar: If you can find out which registrar hosts unwanteddomain.com, file a complaint about malicious forwarding (though success varies by provider).
• Verify SSL setup: Make sure your client’s Squarespace site has a valid SSL certificate to avoid mixed-content errors during redirects.

内容的提问来源于stack exchange，提问作者Vijeth Shetty