Network allowlist for the Landing Page Editor

The Landing Page Editor loads assets, fonts, media search results, and thumbnails from several external hosts, and a strict firewall, proxy, or web filter has to allow them for the editor to work fully.

Missing images, fonts that never load, or an empty media search usually trace back to one of the destinations below being blocked. Allow HTTPS (TCP port 443) to each, grouped by what it serves.

Core editor and API

https://v1.page-assets.topol.io
https://api.topol.io
https://app.topol.io

v1.page-assets.topol.io serves the loader and the editor iframe; api.topol.io is the API the editor and your backend call. app.topol.io hosts the default premade-templates endpoints, so it is only needed when the premade template library is enabled without custom endpoints.

Fonts

https://fonts.googleapis.com
https://fonts.gstatic.com

fonts.googleapis.com returns the font stylesheets and fonts.gstatic.com serves the font files they reference, so both are needed for web fonts to render, including the editor's default font list.

Media search and stock images

https://api.giphy.com/v1/gifs/search
https://api.pexels.com
https://images.pexels.com

Giphy powers the GIF search, with the resulting GIFs served from Giphy's media hosts (media*.giphy.com). The Pexels stock-image tab, enabled by default in the file manager, queries api.pexels.com and loads the resulting thumbnails from images.pexels.com.

Video embeds

https://www.youtube.com

The video block converts YouTube links (including Shorts and Live URLs) into www.youtube.com/embed/ iframes, which the canvas and preview load directly. Any other valid URL is embedded unchanged, so if your users paste videos from another provider, allow that provider's host too.

Image editor and content assets

https://d3ayqk5orocicw.cloudfront.net
https://cdn.jsdelivr.net
https://storage.googleapis.com
https://d5aoblv5p04cg.cloudfront.net
https://d70shl7vidtft.cloudfront.net

d3ayqk5orocicw.cloudfront.net loads the image-editor engine, cdn.jsdelivr.net loads the code-view editor, and storage.googleapis.com together with d5aoblv5p04cg.cloudfront.net host premade-block and template preview images. d70shl7vidtft.cloudfront.net serves the Giphy attribution badge in the GIF picker.

WARNING

Blocking any of these leaves the matching feature degraded, so broken images, missing fonts, or an empty media search point to a host that is still filtered.

Differences from the Email Editor

The Email Editor's allowlist is similar but not identical: the Landing Page Editor loads from v1.page-assets.topol.io instead of v3.email-assets.topol.io, and adds app.topol.io for premade templates. It needs no Vimeo or YouTube thumbnail hosts, because it embeds videos as live iframes rather than fetching a still image to place in the message.