Site Preview
Site Preview opens your live website inside the SimpleCommenter dashboard so you and your team can leave and review comments without installing anything on the site. Open a project and click Preview in the sidebar.
How It Works
The preview does not load your site directly. SimpleCommenter's preview servers fetch the page for you, add the commenting tools, and display the result inside the dashboard. This is why the preview can work on sites that don't have the widget installed.
Because the request comes from our servers instead of your browser, a few things behave differently than a normal visit:
- Pages behind a login on your website cannot be previewed
- Sites on private networks (localhost, internal tools) cannot be reached
- Firewalls and bot protection on your site may block the preview servers
Requirements
- The project must have the Public Website setting enabled in its project settings
- The website must be publicly reachable over http:// or https://
Troubleshooting
When a page fails to load, the preview shows an error card explaining what went wrong and how to fix it. The most common cases are below.
Access Forbidden (403)
The preview shows "Access Forbidden - The website denied access to this page" even though the site opens fine in a normal browser tab.
This means your website's firewall or bot protection is blocking requests from SimpleCommenter's preview servers. The block is not caused by SimpleCommenter; the site's security layer treats the preview request as automated traffic and rejects it.
Common sources of the block:
- Cloudflare or another WAF with bot protection enabled
- Hosting firewalls (many managed WordPress hosts block datacenter traffic by default)
- WordPress security plugins such as Wordfence, Sucuri, or Solid Security
- IP allowlists or password protection on staging environments
How to fix it: every preview request includes the HTTP header
X-SimpleCommenter-Proxy: 1 so you can safely allow it through:
- Cloudflare: create a WAF custom rule that skips bot protection when the
request contains the header
X-SimpleCommenter-Proxywith value1 - WordPress security plugins: add an allowlist/bypass rule for requests with that header, or temporarily disable the firewall to confirm it is the cause
- Other firewalls: ask whoever manages the site's security to allow requests carrying this header
If you can't change the site's security settings, you don't need the preview: install the widget snippet (or the WordPress plugin) on the site, or use the Chrome extension. Both run directly in your browser, so the site's firewall never sees a proxy request.
Other Common Errors
| Error | What it means | What to do |
|---|---|---|
| Website Requires Login (401) | The page is behind a login on your website | Login-protected pages can't be previewed. Use the widget or Chrome extension instead. |
| Page Not Found (404) | The path doesn't exist on your website | Check the URL for typos in the preview address bar. |
| Enable Public Website | The project isn't marked as a public website | Open project settings, enable Public Website, and retry. |
| Secure Session Expired | Preview sessions are short-lived for security | Refresh the preview page to start a new session. |
| Private Network Blocked | The URL points to localhost or an internal network | Only public websites can be previewed. Use the widget snippet for local development. |
| Connection Refused / Domain Not Found | The site is down or DNS is misconfigured | Open the site directly in a new tab to check it is online. |
| Iframe Embedding Blocked | The site has strict anti-framing protections | View the site directly and use the widget or Chrome extension for commenting. |
Preview limitations only affect the Site Preview feature. The embedded widget and the Chrome extension work independently of the preview servers.