diff --git a/src/admin/liveControls.ts b/src/admin/liveControls.ts
index d8f18870..aa05d951 100644
--- a/src/admin/liveControls.ts
+++ b/src/admin/liveControls.ts
@@ -14,7 +14,16 @@ export const LIVE_CONTROLS_SCRIPT = `
   if (window.__DECO_LIVE_CONTROLS__) return;
   window.__DECO_LIVE_CONTROLS__ = true;
 
+  var TRUSTED_ORIGINS = ["https://deco.cx", "https://admin.deco.cx", "https://play.deco.cx"];
+  function isTrustedOrigin(origin) {
+    return TRUSTED_ORIGINS.indexOf(origin) !== -1 ||
+      (origin.startsWith("https://") && origin.endsWith(".deco.cx")) ||
+      origin === window.location.origin;
+  }
+
   addEventListener("message", function(event) {
+    if (!isTrustedOrigin(event.origin)) return;
+
     var data = event.data;
     if (!data || typeof data !== "object") return;
     switch (data.type) {