Skip to content
Hypamoon
Add to ChatGPT Add to Claude
API docs

Start for free. Sign up without a card and you'll get a test project and a test key right away. Once your company (or, for a personal account, you) is verified, you can create a live key in the portal.

Errors

site_blocked

Status
422
Type
https://hypamoon.com/docs/errors/site_blocked

We check every deploy before it goes live, and this one was not published. The check is automatic: no person looked at it. reasons lists what we found, each with a code, the path of the file (or slug or name) and a message you can show the user:

  • sensitive_input: an input field for a password, PIN code, card number or CVC. Sites cannot ask for these. To keep a site private, use the password option of the site; to take payments, link to the payment page of your payment provider.
  • external_form: a form that sends what visitors type to another site. Use a collection with public_write and the form snippet instead. A search box that sends to a search engine with method="get" is fine.
  • hidden_iframe: an iframe nobody can see (hidden, or 0 or 1 pixel). The noscript tag of Google Tag Manager is fine.
  • inline_iframe: an iframe with its page inside it (srcdoc or a data: address). Put that page in its own file.
  • external_redirect: a meta refresh, or a script that sends visitors to another domain by itself when the page loads. A link or a button the visitor clicks is fine.
  • obfuscated_script: code that hides what it does, like eval(atob(...)) or output of an obfuscator. Minified code is fine.
  • brand_login: fields for a username, customer number, IBAN or a login or verification code on a page whose title, main heading, slug or name carries the name of a bank, government service, parcel or payment service or large platform. For platforms like Google or Instagram, only a code field counts.
  • brand_in_address: the slug or name combines such a brand with a word like login or verify.
  • pdf_script: a PDF with embedded JavaScript or an action that starts a program (/Launch). Export it again without scripts, for example with "Save as PDF".
  • In a PDF, external_form is a form that submits to another host, and brand_login is a PDF with such a brand, a link to another site and a phrase like "log in", "verify your account" or "pay now".

Video and audio are only checked on their type (the first bytes) and size.

Fix what the reasons say and deploy again with all files. There is no way to skip the check. If you think it is wrong, email hello@hypamoon.com with the site address and the request_id.