@paul @aurynn Do you have "authorized fetch" enabled? Otherwise, blocking a domain doesn't keep them from fetching your API data anonymously.