General Settings in Rocket Chat Workspace

The General settings control workspace-wide behavior, including the site URL and name, connection and security options, unread counters, CDN configuration, and more.

To access the general settings of your workspace, navigate to Manage → Workspace → Settings → General.

General workspace settings

Field	Description
Show Setup Wizard	Do not alter this setting. It is set automatically from `Pending` through `In Progress` to `Completed`, depending on whether your workspace's general setup procedure has been completed. Changing it manually can lock your workspace. Refer to this issue for details.
Site URL	Enter the URL of the workspace. Example: `https://chat.domain.com/`
Site Name	Enter the name of the workspace. Example: `My Rocket.Chat Server`
Document Domain	Enter the document domain. See the Document: domain property for details.
Language	Select the default language for the workspace. This setting does not override a user's own language preference. Refer to the Account - Localization settings for language preference priority in Rocket.Chat.
Allow Invalid Self-Signed Certs	Enable this setting to allow invalid and self-signed SSL certificates for link validation and previews.
Enable Content-Security-Policy	Do not disable this setting unless you have a custom build and are having problems due to inline scripts.
Use Rocket.Chat SDK	Enable this experimental setting to route Meteor DDP traffic through the `@rocket.chat/ddp-client` package over a single WebSocket. This feature is experimental and available from Rocket.Chat 8.5. Restart your browser tab after toggling it on or off.
Extra CSP Domains	Enter extra domains to add to the Content-Security-Policy.
Restrict access inside any Iframe	Enable this setting to restrict loading Rocket.Chat inside any iframe.
Options to X-Frame-Options	Enter the value for the `X-Frame-Options` header. See X-Frame-Options for the available options.
Enable Favorite Rooms	Enable this setting to allow users to mark a room as a favorite. See how to mark rooms as favorite.
First Channel After Login	Enter the channel that users join by default after logging in. If this field is empty or contains an invalid name, users are directed to the workspace home page. Example: `#general`
Unread Count	Select the behavior of the unread counter: All messages: All unread messages are counted, regardless of whether users are mentioned. User mentions only: Only mentions using `@yourUsername` are counted. Group mentions only: Only group mentions using `@all` or `@here` are counted. User and group mentions only: All mentions are counted, including `@all`, `@here`, and `@yourUsername`.
Unread Count for Direct Messages	Select the behavior of the unread counter for direct messages: All messages: All unread messages are counted. Mentions only: Only mentions using `@yourUsername` are counted.
Unread Count for Omnichannel Chats	Select the behavior of the unread counter for Omnichannel chats: All messages: All unread messages are counted. Mentions only: Only mentions using `@yourUsername` are counted.
DeepLink_Url	Enter the deep link URL. See Deep linking for details.
CDN Prefix	To load your workspace assets from a CDN, enter your CDN prefix here. For more details, refer to the CDN document.
Use CDN Prefix for all assets	Enable this setting if all workspace assets are served from a CDN. When enabled, the CDN Prefix for JS/CSS field is disabled.
CDN Prefix for JS/CSS	Enter the prefix for the CDN that loads the JS/CSS assets. This field is available only when Use CDN Prefix for all assets is disabled.
Force SSL	Enable this setting to force SSL on your workspace. We strongly discourage using this setting; redirect to HTTPS at the reverse proxy level instead. This option exists for deployments such as Heroku, which do not allow redirect configuration at the reverse proxy.
Google Tag Manager Id	Enter your Google Tag Manager ID to use Tag Manager with your workspace.
Bugsnag API Key	Enter your Bugsnag API key to integrate Bugsnag error reporting with your workspace.
Restart The Server	Click this button to restart the Rocket.Chat server. Some settings on this page take effect only after a restart.
Store Last Message	Enable this setting to store the last message sent in each room. The last message appears in the sidebar when Sidebar Channel List Mode is set to `Extended` in the Accounts settings.
Robots.txt File Contents	Enter the contents of the robots.txt file, which controls how search engine crawlers access your workspace.
Default Referrer Policy	Select the `referrer` header that is sent when requesting embedded media from other workspaces. For more information, refer to MDN. A full page refresh is required for this setting to take effect.

Select Restore defaults to revert the settings in this section to their default values.

REST API settings

In the General settings, select the REST API tab to modify your workspace's REST API settings.

Field	Description
Max Record Amount	Enter the maximum number of records the REST API returns when not set to unlimited.
Default Count	Enter the default count for REST API results if the consumer did not provide one.
Allow Getting Everything	This setting affects the `count` query parameter. See Offset and Count Information for details. Enabled: Allows the use of `0` as the `count` parameter. Setting `count` to `0` returns all the data from that endpoint. Disabled: Setting `count` to `0` returns no results.
Enable Direct Message History Endpoint	Enable this setting to activate the `/api/v1/im.messages.others` endpoint, which allows viewing direct messages sent between other users that the caller is not part of.
Enable Shields	Enable this setting to allow the use of shields via the API. Shields are available at `/api/v1/shield.svg`.
Shield Types	Enter the types of shields to enable as a comma-separated list. Choose from `online`, `channel`, or `*` for all.
Require authentication for users shields	Enable this setting to require user authentication for shields.
Enable CORS	Enable CORS for the REST API. When enabled, the workspace accepts API calls only from the origins you specify. When disabled, the workspace accepts requests only from its own domain.
CORS Origin	Enter the origins that are allowed to make requests to your workspace. Use `*` to accept requests from all origins. For multiple origins, use a comma-separated list. Example: `https://domain1.com, https://domain2.com, https://domain3.com`
Apply permission `view-outside-room` to api `users.list`	Enable this setting to enforce the `view-outside-room` permission on the `users.list` API endpoint. This is a deprecated, temporary setting. It will be removed in the next major release, after which the permission is always enforced.
User Limit for Adding All Users to Channel	Enter the maximum number of users that can be added to a channel simultaneously.

Select Restore defaults to revert the settings in this section to their default values.

Translation settings

In the General settings, expand the Translations section.

Custom Translations: Configure custom translations for your workspace. Enter a valid JSON object where each key is a language containing a dictionary of keys and translations. Select Full Screen to expand the editor. For example:

{
 "en": {
  "Channels": "Rooms"
 },
 "pt": {
  "Channels": "Salas"
 }
}

Time zone settings

In the General settings, expand the Time zone section.

Field	Description
Default timezone for reporting	Select the default timezone used when showing dashboards or sending emails. The options are as follows: Server timezone: Uses the Rocket.Chat server timezone for all workspace users. Custom timezone: Uses a specific timezone that you select for all workspace users. User's current timezone: Uses each user's own timezone.
Custom timezone	If you select Custom timezone as the default timezone, select the timezone of your choice from the drop-down menu. If you select any other option, this setting is disabled.

Field

Description

Default timezone for reporting

Select the default timezone used when showing dashboards or sending emails. The options are as follows:

Server timezone: Uses the Rocket.Chat server timezone for all workspace users.
Custom timezone: Uses a specific timezone that you select for all workspace users.
User's current timezone: Uses each user's own timezone.

Custom timezone

If you select Custom timezone as the default timezone, select the timezone of your choice from the drop-down menu. If you select any other option, this setting is disabled.

Iframe integration settings

In the General settings, expand the Iframe Integration section.

For details on configuring iframes, see the Iframe Integration section.
To use the microphone, camera, and geolocation in an iframe, allow them in the iframe features policy. For example,
<iframe src="https://open.rocket.chat/" allow="geolocation; microphone; camera"></iframe>

Field	Description
Enable Send	Enable this setting to allow Rocket.Chat to send events to the parent window.
Send Target Origin	Enter the origin, with protocol prefix, that commands are sent to. Example: `https://localhost`. Use `*` to allow sending to any origin.
Enable Receive	Enable this setting to allow a parent window to send commands to Rocket.Chat.
Receive Origins	Enter the origins, with protocol prefix and separated by commas, that are allowed to send commands. Example: `https://localhost, http://localhost`. Use `*` to allow receiving from any origin.

Select Restore defaults to revert the settings in this section to their default values.

Notifications settings

In the General settings, expand the Notifications section.

Max Room Members Before Disabling All Message Notifications: Enter the maximum number of room members before notifications for all messages are disabled. Users can still change the per-room setting to receive all notifications individually. Enter 0 to disable this limit.

NPS settings

In the General settings, expand the NPS section.

Enable NPS Survey: Enable this setting to run the NPS survey for all users. Administrators receive an alert two months before the survey is launched.

For more details, refer to Net Promoter Score (NPS) survey.

SSRF protection

The SSRF protection setting is available in version 8.2.0 and later.

A server-side request forgery (SSRF) vulnerability allows an attacker to force a server to send requests to any domain or IP address of their choosing. In Rocket.Chat's case, an attacker could craft a malicious URL (for example, in a webhook or message preview) that tricks the server into making requests to cloud metadata services, exposing API keys, credentials, and other internal data.

By default, Rocket.Chat's outbound HTTP requests are automatically screened to defend against SSRF attacks. Before any connection is allowed, the destination URLs are resolved and checked against a blocklist of restricted IPs and private network ranges.

A few trusted outbound HTTP requests are not scanned by Rocket.Chat. This is because the URLs are either hardcoded or can only be defined by a workspace admin.

In the General settings, expand the SSRF protection section and update the following option only if you want to allow specific domains or IPs:

Field	Description
SSRF allowlist	Enter the domains, IPs, or IP:port values that are allowed for outbound requests despite SSRF protection. Enter one value per line, or separate values with commas. Use this field only for trusted internal hosts. Examples: `internal.corp`, `192.168.1.1`, `192.168.1.1:8080`

By default, Rocket.Chat implements multiple security layers as follows. This is only for your information, and no further action is required:

Block internal IP ranges: Restricts all private IP ranges and internal cloud service IPs.
Protocol restrictions: Allows only HTTP and HTTPS, blocking schemes such as gopher://, ftp://, and file://, which could be used to read local files or reach internal services.
Validate redirects: Prevents attackers from registering an unblocked domain that redirects to a blocked IP or domain. For example, this prevents evil.io from redirecting to the metadata service at 169.254.169.254.
Domain lookups: Resolves domain names to their IP addresses and blocks those that point to restricted IP addresses, preventing attackers from registering domains that resolve to internal addresses.
Block different IP formats: Considers different representations of the same address. For example, localhost can be written as 127.0.0.1, [::1], 2130706433 (decimal), or 0177.0.0.1 (octal). To prevent SSRF validation bypasses, Rocket.Chat accepts only formats such as 127.0.0.1 and [::1].

Stream Cast settings

This feature is deprecated and will be removed in future versions.

If you are using Stream Cast, expand the Stream Cast section in the General settings.

Stream Cast Address: Enter the IP or host of your Rocket.Chat central Stream Cast. Example: 192.168.1.1:3000 or localhost:4000

Update settings

In the General settings, expand the Update section to modify your workspace's update checker settings.

Field	Description
Update Latest Available Version	Displays the latest available version.
Enable the Update Checker	Enable this setting to receive new update notifications and important messages from Rocket.Chat developers. The notification appears once per new version as a clickable banner and as a message from the Rocket.Cat bot, both visible only to administrators.

Select Restore defaults to revert the settings in this section to their default values.

UTF8 settings

In the General settings, expand the UTF8 section to configure the name validation rules for usernames and rooms. If you are having problems with names when creating channels, such as when using non-English characters, adjusting these values usually resolves it. For example, using [\w_-]+ allows any non-space character to be part of a name.

Field	Description
UTF8 Usernames Validation	Enter the regular expression used to validate usernames. The default value is `[0-9a-zA-Z-_.]+`. Example: To allow Japanese strings, enter the regex `[\u3040-\u309f\u30a0-\u30ffーa-zA-Zａ-ｚＡ-Ｚ0-9\u4e00-\u9fff-０-９-、。_.]+`. This allows you to create usernames containing Japanese characters; avatars are displayed using the first character.
UTF8 Channel Names Validation	Enter the regular expression used to validate channel names. The default value is `[0-9a-zA-Z-_.]+`. Example: To allow Japanese strings, enter the regex `[\u3040-\u309f\u30a0-\u30ffーa-zA-Zａ-ｚＡ-Ｚ0-9\u4e00-\u9fff-０-９-、。_.]+`. This allows you to create channels containing Japanese characters; channel avatars are displayed using the first character.
UTF8 Names Slugify	Enable this setting to create slugs for names.

Field

Description

UTF8 Usernames Validation

Enter the regular expression used to validate usernames. The default value is [0-9a-zA-Z-_.]+.

Example:

To allow Japanese strings, enter the regex [\u3040-\u309f\u30a0-\u30ffーa-zA-Zａ-ｚＡ-Ｚ0-9\u4e00-\u9fff-０-９-、。_.]+. This allows you to create usernames containing Japanese characters; avatars are displayed using the first character.

UTF8 Channel Names Validation

Enter the regular expression used to validate channel names. The default value is [0-9a-zA-Z-_.]+. Example: To allow Japanese strings, enter the regex [\u3040-\u309f\u30a0-\u30ffーa-zA-Zａ-ｚＡ-Ｚ0-9\u4e00-\u9fff-０-９-、。_.]+. This allows you to create channels containing Japanese characters; channel avatars are displayed using the first character.

UTF8 Names Slugify

Enable this setting to create slugs for names.

Select Restore defaults to revert the settings in this section to their default values.

App settings

In the General settings, expand the Apps section.

Field	Description
Apps' Source Package Storage type	Select where the apps' source code is stored. Each app can be multiple megabytes in size. The options are GridFS and FileSystem. Changing where the apps are stored may cause instabilities in apps that are already installed.
Directory for storing apps source package	Enter the absolute path in the filesystem for storing the apps' source code (in `.zip` file format). This field is available only when FileSystem is selected as the storage type. Make sure the directory exists and Rocket.Chat has read and write access to it.

Field

Description

Apps' Source Package Storage type

Select where the apps' source code is stored. Each app can be multiple megabytes in size. The options are GridFS and FileSystem.

Changing where the apps are stored may cause instabilities in apps that are already installed.

Directory for storing apps source package

Enter the absolute path in the filesystem for storing the apps' source code (in .zip file format). This field is available only when FileSystem is selected as the storage type. Make sure the directory exists and Rocket.Chat has read and write access to it.

Documentation Index

General Settings

General workspace settings

REST API settings

Translation settings

Time zone settings

Iframe integration settings

Notifications settings

NPS settings

SSRF protection

Stream Cast settings

Update settings

UTF8 settings

App settings