{cta}
This is useful when you want to show your brand or custom domain instead of the actual destination URL.
When this is enabled, your short link will be shown in your users' browser address bar when they visit your link instead of the destination URL.
## Link cloaking caveats
A few caveats for the link cloaking feature:
1. For link cloaking to work, make sure you use `https` for your destination URL. If your destination URL is `http`, the browser will show a "Not Secure" warning, and link cloaking will not work.
2. Link cloaking might not work for certain websites that have security measures in place to prevent this:
* `X-Frame-Options` header set to `DENY`
* `content-security-policy` header set to `frame-ancestors 'none'`
## Link cloaking with security headers
If you have control over the destination URL that you are cloaking, you can leverage security headers to enable link cloaking on Dub while also disabling iframe embedding everywhere else.
### Adding security headers to your destination URL
To do this, you need to whitelist your [Dub short domain](/help/article/how-to-add-custom-domain) as an allowed origin on your site by adding the following response headers to your site:
```bash theme={null}
Content-Security-Policy: frame-ancestors 'self' [shortdomain.com]
```
For example, if your Dub short domain is `dub.sh`, you would need to add the following headers to your destination URL:
```bash theme={null}
Content-Security-Policy: frame-ancestors 'self' dub.sh
```
### Whitelisting multiple domains
You can also whitelist multiple domains by separating them with a space:
```bash theme={null}
Content-Security-Policy: frame-ancestors 'self' dub.sh otherdomain.com
```
This will ensure that your site cannot be embedded in third-party sites but can still be cloaked by your Dub short domain.
### Secure link cloaking demo
Here's a demo of how this works: