Network Access

What to do when your app won't load because a corporate network, ISP or security tool is blocking it

Some "the app won't load" reports are not app configuration problems but the network between your user and Noloco dropping the connection. Corporate firewalls, ISP-level content filters, DNS filtering, VPNs, antivirus web shields and browser extensions can all block a Noloco app while the app itself is perfectly healthy.

This page is for app owners to share with their IT team.

Symptoms of a network block

A network block usually looks different from an app error:

• The app never loads — a blank page, a spinning loader, or a browser error like ERR_CONNECTION_TIMED_OUT, ERR_NAME_NOT_RESOLVED or "This site can't be reached"

• Users under same office network, VPN or ISP are affected

• The same user can load the app on mobile data but not on the office Wi-Fi

• The login screen loads but no data appears, or actions hang forever

Quickest test: ask the affected user to open the app on their phone with Wi-Fi turned off. If it works on mobile data, the problem is the network, not the app.

Domains to whitelist

Ask your IT team to allow these domains through your firewall, web proxy, DNS filter and antivirus web scanning:

Domain	What it's used for
portals.noloco.io	The Noloco builder, where you edit your app
*.noloco.co	Published apps on a Noloco subdomain
api.core.noloco.io	The API every app calls to load and save data
ssl.noloco.co	The certificate host that custom domains point at
*.noloco.app	Links in transactional emails, including magic links

If you use a custom domain, your own domain also needs to be allowed — but so do api.core.noloco.io and ssl.noloco.co, because the app still loads its data from Noloco's API and its certificate through ssl.noloco.co.

Allowing only your custom domain is the most common half-fix. The page loads, then sits empty or shows errors, because api.core.noloco.io is still blocked.

Your app may also load from services you've connected yourself, like your data source, an embedded iframe, or a script added in Custom Code. Those domains need to be allowed too.

Configuring network security tools

1. Allow the domains above on the firewall, web proxy and DNS filter, including subdomains where a wildcard is listed.

2. Don't rewrite Noloco URLs. Link scanners that rewrite or pre-fetch links can break single-use authentication tokens. Add Noloco domains to the exclusion list.

3. Check for TLS inspection. Proxies that decrypt and re-sign HTTPS traffic can break the connection to api.core.noloco.io, so the page loads but no data does. Exclude Noloco domains from inspection.

4. Check antivirus web shields separately — products like ESET, Kaspersky and Sophos filter traffic independently of the firewall.

5. Check the VPN. Split-tunnel VPNs sometimes route Noloco traffic through a filtered path even when the office network is fine.

Things to rule out on the user's device

Before escalating to IT, ask the affected user to:

1. Try an incognito window — this disables most extensions and ignores cached state

2. Disable browser extensions, particularly ad blockers, privacy tools and screen recorders

3. Clear the browser cache and reload

4. Try a different browser to isolate browser-specific behaviour

5. Try a different network, such as mobile data (not the wi-fi), to confirm whether the network is the cause

When to contact support

Contact support if:

• The app is unreachable from multiple unrelated networks, not just one office

• IT has confirmed the domains above are allowed and the app still won't load

• You can see a specific error in the browser console that isn't a connection error

Include the exact error message, the network the user is on, and whether the app loads on mobile data — that's usually enough to tell a network block apart from a platform issue.

Related: for emails and magic links being blocked rather than the app itself, see Email Settings.