How to restrict AI search to specific websites and trusted domains

To restrict an AI research assistant's search to specific websites or domains, you have four options, and they hold to very different degrees. A domain allowlist set in a search API is the firmest way to keep live web search on chosen sites. Searching only a library of pages you saved yourself is firmer still, because the AI never sees anything else. Source filters in apps and site: operators in prompts help, but the model can still pull in other domains, so you check every citation either way.

This guide covers each method, prompt wording that tends to hold, a short test that shows whether the tool obeyed, and which methods leak. We make Barside, a free desktop app for Windows, Linux and Mac. Its AI search that cites its sources answers only from passages in your own notes, which is the closed-library method in practice.

Four ways to restrict AI search to specific websites or domains

If you want an AI tool to restrict search to specific domains and websites, start by asking where the restriction is enforced. A rule enforced by the search system itself holds better than a rule the model is asked to follow, because a model can misread, forget or overrule an instruction partway through a long research run.

For Perplexity and other consumer research apps, the source controls change over time, so read the app's own help pages for what it offers in 2026 before you rely on a domain filter. Perplexity answers with links to the pages it used, which makes its results easy to test with the routine later in this guide. Whatever a control is called, treat it as a claim until your test confirms it.

Prompt wording that keeps an AI tool on trusted sites

To make an AI tool search within a specific domain and stick to trusted sources, write the sites into the prompt and give the model a way to fail politely. Most leaks happen when the allowed sites lack an answer and the model reaches for another page sooner than admit it. The site: operator works in many search engines when you type it yourself, but in an AI tool the model writes its own queries and may drop or rewrite it.

Wording that tends to hold looks like this:

• Name the domains exactly. Write who.int, cdc.gov, nih.gov in place of "official health sites."
• Ask for the operator in every query. "Run every search with site:who.int OR site:cdc.gov. Do not search without it."
• Give an exit. "If these sites do not answer the question, reply with Not found in allowed sources and stop."
• Demand a link per claim. "After each sentence, cite the full URL you took it from."
• Ask for a source list at the end. "List every domain you opened, including ones you did not cite."

The exit line matters most. Without it, a model that finds nothing on your list often fills the gap from a blog or a forum and cites it anyway. Even with all five lines, a prompt stays a request, so the test below still applies.

Domain allowlists in search APIs

If you build tools on an AI company's API, you can set allowed domains in the search tool itself. OpenAI's web search tool guide and Anthropic's web search tool documentation both describe domain filtering for search results. Because the filter applies before results reach the model, it holds much better than a sentence in a prompt.

Two gaps remain. A model can still answer from its training data with no search at all, and that answer may carry no citation or a citation it recalled rather than found. Pages on an allowed domain can also quote or link to other sites, so a trusted domain is not the same as a trusted claim. Pair the allowlist with the exit line from the previous section and keep checking citations.

How do you search only pages you saved yourself in Barside?

The closed-library method answers from a set of pages you already chose and read. Barside's Ask library searches your notes on your computer, keeps the six best passages with at most two from any one note, and asks your AI to answer only from them, with numbered sources. Nothing from the open web enters the answer.

1. Download Barside and open it.
2. Open Settings → AI and connect Claude, ChatGPT, Gemini or OpenRouter. Under AI spending limit, turn on Limit what Barside's AI spends and pick an amount.
3. Make a workspace for your trusted sources, for example "Trusted sources: policy." Choose it from the selector above each note you file there.
4. Fill it with the pages you trust. Keep a copy of a page with saved webpages for offline reading, or paste the passages you need into a note with the page's address.
5. To gather fresh pages from sites you name, open Agents & approvals → Research, type a Question, add up to 5 Links to read first, pick your workspace under Save the note in and press Start research. The note cites each fact like [1], and readable copies of the pages are saved as bookmarks on the note so AI search can find them later.
6. Open Library & briefing, go to the Sources tab and, under Choose included workspaces & notes, untick every workspace except your trusted one.
7. On the Ask library tab, type into Ask your entire library and press Ask library. Click a source's title under From your library to open the note.

One detail helps a lot: search matches words, not meaning, so phrase questions with the words your saved pages use. The research agent reads up to 5 public pages in total, with at most two from one site, and it can also search DuckDuckGo. Its card lists every site Barside contacted, which tells you at once whether it stayed on your links.

How to test whether the tool obeyed

A restriction is only as good as your last test, so run this check on any tool, setting or prompt before you trust it. It takes about ten minutes.

1. Ask a trap question. Pick a fact that appears only on a site outside your list, such as a detail from one news article. If the tool answers it with a citation, the restriction leaked.
2. Ask a missing question. Ask something your allowed sites do not cover. The right result is your exit phrase or a plain "I could not find this."
3. Check every domain. In five normal answers, look at the address of each citation. One outside domain means the method leaks for your use.
4. Look for uncited claims. A sentence with no source may come from the model's memory, which no domain filter blocks.
5. Open a few sources. Press Ctrl+F on the cited page and search for a phrase from the claim, as in the citation check for AI research tools.
6. Write down the result with the date, since tools and models change.

In practice, prompt-only rules leak most often on trap questions, app filters vary, and API allowlists and closed libraries usually pass the domain check while still needing step 4.

Source quality filtering for AI agents: authoritative sources in the prompt

For an AI agent, source quality filtering for authoritative sources comes down to prompt engineering plus a list you maintain. A fixed allowlist covers the sites you already know. A ranked rule covers the pages the agent finds that you have not seen yet.

A source policy you can paste into an agent's instructions:

• Tier 1: primary sources: the official body, the original study, the court record, the company's own page.
• Tier 2: established publishers that name an author and a date.
• Excluded: copies, aggregators, unsigned pages, forums, and pages with no date.
• Rule: "Use Tier 2 only when no Tier 1 source covers the point, and say which tier each source is."

Asking the agent to label tiers makes its choices visible, so a review takes seconds. In Barside, you can put a policy like this into a scheduled agent's Instructions in Agents & approvals, and the AI agents guide shows how results land in notes while actions wait for Approve.

Examples from real jobs

Marta, a compliance analyst, may cite only regulators. She keeps their guidance pages in one workspace, unticks the rest under Sources, and asks Ask library which reporting deadlines apply. Every answer points to a note she filed herself.

Jon, a health reporter, uses a prompt with named domains and an exit line for discovery, then runs the trap question each Monday. When one answer cited a clinic blog, he moved that topic to his closed library. A graduate student could do the same with papers, using the literature review template as the source list.

Privacy and limits

Your notes stay in Barside's data folder on your computer. When you ask the library, your question and the matching passages go to the AI company you connected, and its data policy applies; see how AI search uses your data and the AI you connect. The research agent uses no cookies and no sign-ins, so pages behind a login usually cannot be read.

Untick sensitive notes under Sources before you ask, since an excerpt already sent cannot be recalled. Barside's search step works offline, but writing the answer needs a connection to your AI company. Each company bills you per use, and pricing trade-offs are in the AI research assistant pricing guide.

Works well with

A closed library pairs well with a habit of saving what you read, so your trusted set grows week by week. The read-it-later guide and the AI assistant, which can save a page to Reading for you, cover that side.