> For the complete documentation index, see [llms.txt](https://help.dscout.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.dscout.com/study-basics/testing-prototypes/mask-task-url.md). # Mask task URL

Study type	Availability
Usability tests	true
Intercept studies	true
AI moderated studies	true

Masking a task URL lets you share a website or prototype with participants without surfacing the exact URL in the browser. This is useful if you're hosting a prototype in a location you don't want to expose publicly, or if you don't want participants to be able to access the prototype again after completing your study. For example, if you've generated a prototype using Claude, Codex, or another AI tool, it's likely you'll need to host that prototype on your own server to share it with others. By masking the task URL in your Dscout study, you can securely share that prototype with participants without displaying the exact hosting location. **Here's how the URL for the Dscout help center appears when unmasked:**

**And here's how it appears with Mask task URL enabled:**

### Enable Mask task URL Mask task URL is enabled on a per-question basis. You'll need to enable it on every task question in your study where you want it applied, even if those questions share a task URL. {% hint style="info" %} **Note:** Mask task URL is enforced automatically when using an uploaded HTML file on a task question. {% endhint %} **To mask a task URL:** {% stepper %} {% step %} In your study, click to edit a task question (or add a new question with a task URL). {% endstep %} {% step %} Set the **Mask task URL** toggle to **ON**.

{% endstep %} {% endstepper %} Dscout automatically checks whether a URL can be masked. However, for domains we can't confidently verify, you'll see a preview info banner displayed. Here, click **Preview** to test your URL with masking enabled:

A preview modal opens showing exactly what your participants will see during your study. If you can access your site or prototype as you want participants to, masking is successful. Click **Looks good** to continue building your study:

If you see an error like the one below (or run into other issues testing your provided URL), we aren't able to mask your URL as configured. Click **Turn off masking** to disable Mask task URL, then refer to the [Troubleshooting](#troubleshooting) section below to resolve the issue:

{% hint style="warning" %} **Warning:** If you do not disable Mask task URL on a URL Dscout cannot mask, your participants will not be able to complete your study effectively. {% endhint %} ### Troubleshooting Depending on where or how you built your prototype, Dscout may be unable to mask the URL for a number of reasons. However, many of these can be addressed with simple settings or code changes on your end. Refer to the drop-downs below for more information:

If you're using Claude

Whether a Claude prototype can be masked depends on how it was shared, not just which Claude plan you're on. **Artifacts published from a chat can be masked.** This is the only kind of Claude prototype Dscout can mask. On Claude Free, Pro, and Max, publishing an artifact from a chat gives you an embed option with an **Allowed domains** field, and adding Dscout there is usually all it takes: {% stepper %} {% step %} Open your artifact in Claude and publish it. {% endstep %} {% step %} Find **Allowed domains** in the artifact's sharing settings. {% endstep %} {% step %} Add `app.dscout.com`. {% endstep %} {% step %} In Dscout, delete the task URL and add it again. {% endstep %} {% endstepper %} Published chat artifacts are also the only kind your participants can open without a Claude account of their own. **Artifacts shared with the Share button can't be masked.** Claude Design projects, templates, and anything shared from Claude Code use Claude's newer Share button, which has no embed or **Allowed domains** setting on any plan. These will always open in a new tab with the URL visible. Participants also need their own Claude account to open them, even when the link is set to "Anyone with the link"—so they're a poor fit for a study whether or not masking is involved. **Claude Design links can't be masked.** Here's how those URLs look: `claude.ai/design/p/...` **On Claude Team and Enterprise, check with your Claude admin.** Embedding isn't available on these plans, so an artifact will always open in a new tab with the URL visible. Sharing outside your organization is also up to your admin: "Anyone with the link" only works if an Owner has turned on **External sharing** or allowed that specific artifact. Otherwise, participants outside your organization won't be able to open the link at all. If you continue to have issues, let our Support team know—we're happy to help.

If you're using Figma Make, Replit, Vercel, Netlify, Lovable, Bolt, or similar

If you run into an issue with something built with these tools, it likely comes down to something added to the project or prototype without you knowing—either by the person who built it or an AI coding agent (if one was used). Check the prototype (or ask whoever built it) for the following: * **An `X-Frame-Options` header set to `DENY` or `SAMEORIGIN`:** If one exists, remove it. This header can't selectively allow `app.dscout.com`, so removing it is the only fix. * **A `Content-Security-Policy` with a `frame-ancestors` rule:** If one exists, remove it, or ensure it includes `app.dscout.com`. * **A login wall inside the page:** Dscout can't sign in to sites on a participant's behalf, so a login blocks masking even if the page technically loads. * **"Frame-busting" JavaScript:** If this exists, remove it as it prevents Dscout from properly embedding the target URL. * **Cookies set as `SameSite=Lax`:** If this exists, remove it as it can let the page render but keep participants logged out. {% prompt description="Here's a prompt to give AI coding agents:" icon="sparkles" defaultExpanded="full" %} ```markdown This page will be shown inside an iframe on app.dscout.com. Remove any X-Frame-Options header entirely — it can't be scoped to a single domain. If there's a Content-Security-Policy frame-ancestors rule, either remove it or update it to allow framing from https://app.dscout.com. Also check for and remove any JavaScript that breaks out of iframes. ``` {% endprompt %}

If you're using a domain you or your organization controls

For domains where you have control, you need to make sure your domain allows `app.dscout.com` to embed it. Talk to your organization's web admin or IT team, providing them with the following: > I need `[your prototype URL]` to be embeddable in an iframe hosted at `https://app.dscout.com`, for a user research session. Can you check whether `X-Frame-Options` or a `Content-Security-Policy` `frame-ancestors` rule is set on this domain? If so, can we either remove it or add `https://app.dscout.com` to the allowed `frame-ancestors` list? A few tips: * Give them the exact URL, not just the domain. Some setups apply different rules per path. * Ask them to confirm once it's changed. Then, delete the task URL from your study and add it again to trigger a fresh check. * If their policy doesn't allow loosening this (some organizations block all framing company-wide), treat it like the case below.

If you're using a live site you don't control

If your task URL points to a site you didn't build (for example, a competitor's product or a public site you're testing against), hiding the URL isn't possible. You don't own that site's security settings, and Dscout can't override them. The task will always open in a new tab with the URL visible.

If you run into an issue not covered in the sections above, contact [Dscout Support](mailto:help@dscout.com) for assistance. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.dscout.com/study-basics/testing-prototypes/mask-task-url.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.