Mask task URL

Study type	Availability
Usability tests
Intercept studies
AI moderated studies

Masking a task URL lets you share a website or prototype with participants without surfacing the exact URL in the browser. This is useful if you're hosting a prototype in a location you don't want to expose publicly, or if you don't want participants to be able to access the prototype again after completing your study.

For example, if you've generated a prototype using Claude, Codex, or another AI tool, it's likely you'll need to host that prototype on your own server to share it with others. By masking the task URL in your Dscout study, you can securely share that prototype with participants without displaying the exact hosting location.

Here's how the URL for the Dscout help center appears when unmasked:

And here's how it appears with Mask task URL enabled:

Enable Mask task URL

Mask task URL is enabled on a per-question basis. You'll need to enable it on every task question in your study where you want it applied, even if those questions share a task URL.

Note: Mask task URL is enforced automatically when using an uploaded HTML file on a task question.

To mask a task URL:

1

In your study, click to edit a task question (or add a new question with a task URL).

2

Set the Mask task URL toggle to ON.

Dscout automatically checks whether a URL can be masked. However, for domains we can't confidently verify, you'll see a preview info banner displayed. Here, click Preview to test your URL with masking enabled:

A preview modal opens showing exactly what your participants will see during your study. If you can access your site or prototype as you want participants to, masking is successful. Click Looks good to continue building your study:

If you see an error like the one below (or run into other issues testing your provided URL), we aren't able to mask your URL as configured. Click Turn off masking to disable Mask task URL, then refer to the Troubleshooting section below to resolve the issue:

Warning: If you do not disable Mask task URL on a URL Dscout cannot mask, your participants will not be able to complete your study effectively.

Troubleshooting

Depending on where or how you built your prototype, Dscout may be unable to mask the URL for a number of reasons. However, many of these can be addressed with simple settings or code changes on your end. Refer to the drop-downs below for more information:

If you're using Claude

Whether a Claude prototype can be masked depends on how it was shared, not just which Claude plan you're on.

Artifacts published from a chat can be masked. This is the only kind of Claude prototype Dscout can mask. On Claude Free, Pro, and Max, publishing an artifact from a chat gives you an embed option with an Allowed domains field, and adding Dscout there is usually all it takes:

1

Open your artifact in Claude and publish it.

2

Find Allowed domains in the artifact's sharing settings.

3

Add app.dscout.com.

4

In Dscout, delete the task URL and add it again.

Published chat artifacts are also the only kind your participants can open without a Claude account of their own.

Artifacts shared with the Share button can't be masked. Claude Design projects, templates, and anything shared from Claude Code use Claude's newer Share button, which has no embed or Allowed domains setting on any plan. These will always open in a new tab with the URL visible. Participants also need their own Claude account to open them, even when the link is set to "Anyone with the link"—so they're a poor fit for a study whether or not masking is involved.

Claude Design links can't be masked. Here's how those URLs look: claude.ai/design/p/...

On Claude Team and Enterprise, check with your Claude admin. Embedding isn't available on these plans, so an artifact will always open in a new tab with the URL visible. Sharing outside your organization is also up to your admin: "Anyone with the link" only works if an Owner has turned on External sharing or allowed that specific artifact. Otherwise, participants outside your organization won't be able to open the link at all.

If you continue to have issues, let our Support team know—we're happy to help.

If you're using Figma Make, Replit, Vercel, Netlify, Lovable, Bolt, or similar

If you run into an issue with something built with these tools, it likely comes down to something added to the project or prototype without you knowing—either by the person who built it or an AI coding agent (if one was used).

Check the prototype (or ask whoever built it) for the following:

• An X-Frame-Options header set to DENY or SAMEORIGIN: If one exists, remove it. This header can't selectively allow app.dscout.com, so removing it is the only fix.

• A Content-Security-Policy with a frame-ancestors rule: If one exists, remove it, or ensure it includes app.dscout.com.

• A login wall inside the page: Dscout can't sign in to sites on a participant's behalf, so a login blocks masking even if the page technically loads.

• "Frame-busting" JavaScript: If this exists, remove it as it prevents Dscout from properly embedding the target URL.

• Cookies set as SameSite=Lax: If this exists, remove it as it can let the page render but keep participants logged out.

Here's a prompt to give AI coding agents:

This page will be shown inside an iframe on app.dscout.com. Remove any X-Frame-Options header entirely — it can't be scoped to a single domain. If there's a Content-Security-Policy frame-ancestors rule, either remove it or update it to allow framing from https://app.dscout.com. Also check for and remove any JavaScript that breaks out of iframes.

If you're using a domain you or your organization controls

For domains where you have control, you need to make sure your domain allows app.dscout.com to embed it.

Talk to your organization's web admin or IT team, providing them with the following:

I need [your prototype URL] to be embeddable in an iframe hosted at https://app.dscout.com, for a user research session. Can you check whether X-Frame-Options or a Content-Security-Policy frame-ancestors rule is set on this domain? If so, can we either remove it or add https://app.dscout.com to the allowed frame-ancestors list?

A few tips:

• Give them the exact URL, not just the domain. Some setups apply different rules per path.

• Ask them to confirm once it's changed. Then, delete the task URL from your study and add it again to trigger a fresh check.

• If their policy doesn't allow loosening this (some organizations block all framing company-wide), treat it like the case below.

If you're using a live site you don't control

If your task URL points to a site you didn't build (for example, a competitor's product or a public site you're testing against), hiding the URL isn't possible. You don't own that site's security settings, and Dscout can't override them. The task will always open in a new tab with the URL visible.

If you run into an issue not covered in the sections above, contact Dscout Support for assistance.