--- title: "General Settings in Rocket Chat Workspace" slug: "general" status: "update" updated: 2026-11-09T16:30:04Z published: 2026-11-09T16:30:04Z canonical: "docs.rocket.chat/general" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.rocket.chat/llms.txt > Use this file to discover all available pages before exploring further. # General Settings The General settings control workspace-wide behavior, including the site URL and name, connection and security options, unread counters, CDN configuration, and more. To access the general settings of your workspace, navigate to **Manage → Workspace → Settings → General**. ## General workspace settings | Field | Description | | --- | --- | | **Show Setup Wizard** | **Do not alter this setting.** It is set automatically from `Pending` through `In Progress` to `Completed`, depending on whether your workspace's general setup procedure has been completed. Changing it manually can lock your workspace. Refer to this [issue](https://github.com/RocketChat/Rocket.Chat/issues/13840) for details. | | **Site URL** | Enter the URL of the workspace. Example: `https://chat.domain.com/` | | **Site Name** | Enter the name of the workspace. Example: `My Rocket.Chat Server` | | **Document Domain** | Enter the document domain. See the [Document: domain](https://developer.mozilla.org/en-US/docs/Web/API/Document/domain) property for details. | | **Language** | Select the default language for the workspace. This setting does not override a user's own language preference. Each user's own language preference is kept if this setting is changed. For the language preference priority in Rocket.Chat, see [Manage Your Account Settings](https://docs.rocket.chat/v1/docs/manage-your-account-settings#localization). | | **Allow Invalid Self-Signed Certs** | Enable this setting to allow invalid and self-signed SSL certificates for link validation and previews. | | **Enable Content-Security-Policy** | Do not disable this setting unless you have a custom build and are having problems due to inline scripts. | | **Extra CSP Domains** | Enter extra domains to add to the Content-Security-Policy. | | **Restrict access inside any Iframe** | Enable this setting to restrict loading Rocket.Chat inside any iframe. | | **Options to X-Frame-Options** | Enter the value for the `X-Frame-Options` header. See [X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) for the available options. | | **Enable Favorite Rooms** | Enable this setting to allow users to mark a room as a favorite. See how to [mark rooms as favorite](/v1/docs/create-a-new-channel#mark-a-channel-as-favorite). | | **First Channel After Login** | Enter the channel that users join by default after logging in. If this field is empty or contains an invalid name, users are directed to the workspace home page. Example: `#general` | | **Unread Count** | Select the behavior of the unread counter: - **All messages**: All unread messages are counted, regardless of whether users are mentioned. - **User mentions only**: Only mentions using `@yourUsername` are counted. - **Group mentions only**: Only group mentions using `@all` or `@here` are counted. - **User and group mentions only**: All mentions are counted, including `@all`, `@here`, and `@yourUsername`. | | **Unread Count for Direct Messages** | Select the behavior of the unread counter for direct messages: - **All messages**: All unread messages are counted. - **Mentions only**: Only mentions using `@yourUsername` are counted. | | **Unread Count for Omnichannel Chats** | Select the behavior of the unread counter for Omnichannel chats: - **All messages**: All unread messages are counted. - **Mentions only**: Only mentions using `@yourUsername` are counted. | | **DeepLink_Url** | Enter the deep link URL. The default value is `https://go.rocket.chat`. See [Deep linking](https://developer.rocket.chat/docs/deep-linking) for details. | | **CDN Prefix** | To load your workspace assets from a CDN, enter your CDN prefix here. For more details, see [CDN](/v1/docs/cdn). | | **Use CDN Prefix for all assets** | Enable this setting if all workspace assets are served from a CDN. When enabled, the **CDN Prefix for JS/CSS** field is disabled. | | **CDN Prefix for JS/CSS** | Enter the prefix for the CDN that loads the JS/CSS assets. This field is available only when **Use CDN Prefix for all assets** is disabled. | | **Force SSL** | Enable this setting to force SSL on your workspace. We strongly discourage using this setting; redirect to HTTPS at the reverse proxy level instead. This option exists for deployments such as Heroku, which do not allow redirect configuration at the reverse proxy. | | **Google Tag Manager Id** | Enter your [Google Tag Manager](https://marketingplatform.google.com/about/tag-manager/) ID to use Tag Manager with your workspace. | | **Bugsnag API Key** | Enter your [Bugsnag](https://www.bugsnag.com/) API key to integrate Bugsnag error reporting with your workspace. | | **Restart The Server** | Click this button to restart the Rocket.Chat server. Some settings on this page take effect only after a restart. | | **Store Last Message** | Enable this setting to store the last message sent in each room. The last message appears in the sidebar when **Sidebar items view mode** is set to `Extended` in the **Accounts** settings. | | **Robots.txt File Contents** | Enter the contents of the [robots.txt](https://developers.google.com/search/docs/crawling-indexing/robots/intro) file, which controls how search engine crawlers access your workspace. | | **Default Referrer Policy** | Select the `referrer` header that is sent when requesting embedded media from other servers. The default value is `Same origin`. For more information, refer to [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy). A full page refresh is required for this setting to take effect. | Select **Restore defaults** to revert the settings in this section to their default values. --- ## REST API In the **General** settings, select the **REST API** tab to modify your workspace's [REST API](https://developer.rocket.chat/apidocs) settings. | Field | Description | | --- | --- | | **Max Record Amount** | Enter the maximum number of records the REST API returns when not set to unlimited. The default value is `100`. | | **Default Count** | Enter the default count for REST API results if the consumer did not provide one. The default value is `50`. | | **Allow Getting Everything** | This setting affects the `count` query parameter. See [Offset and Count Information](https://developer.rocket.chat/apidocs/query-parameters) for details. - **Enabled**: Allows the use of `0` as the `count` parameter. Setting `count` to `0` returns **all** the data from that endpoint. - **Disabled**: Setting `count` to `0` returns the **Default Count.** | | **Enable Direct Message History Endpoint** | Enable this setting to activate the `/api/v1/im.messages.others` [endpoint](https://developer.rocket.chat/apidocs/message-others-1), which allows viewing direct messages sent between other users that the caller is not part of. | | **Enable Shields** | Enable this setting to allow the use of [shields](https://developer.rocket.chat/apidocs/shield-svg) via the API. Shields are available at `/api/v1/shield.svg`. | | **Shield Types** | Enter the types of shields to enable as a comma-separated list. Choose from `online`, `channel`, or `*` for all. The default value is `*`. | | **Require authentication for users shields** | Enable this setting to require user authentication for shields. | | **Enable CORS** | Enable [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) for the REST API. When enabled, the workspace accepts API calls only from the origins you specify. When disabled, the workspace accepts requests only from its own domain. | | **CORS Origin** | Enter the origins that are allowed to make requests to your workspace. Use `*` to accept requests from all origins. For multiple origins, use a comma-separated list. Example: `https://domain1.com, https://domain2.com, https://domain3.com` The default value is `*`. | | **Apply permission** `view-outside-room` **to api** `users.list` ![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Deprecated (2).svg) | Enable this setting to enforce the `view-outside-room` permission on the `users.list` API endpoint. > [!WARNING] > This is a deprecated and temporary setting. It will be removed in a future major release, after which the permission is always enforced. | | **User Limit for Adding All Users to Channel** | Enter the maximum number of users that can be added to a channel simultaneously. The default value is `500`. | Select **Restore defaults** to revert the settings in this section to their default values. --- ## Translation In the **General** settings, expand the **Translations** section. - **Custom Translations**: Configure custom translations for your workspace. Enter a valid JSON object where each key is a language containing a dictionary of keys and translations. Select **Full Screen** to expand the editor. For example: ```json { "en": {  "Channels": "Rooms" }, "pt": {  "Channels": "Salas" } } ``` --- ## Time zone In the **General** settings, expand the **Time zone** section. | Field | Description | | --- | --- | | **Default timezone for reporting** | Select the default timezone used when showing dashboards or sending emails. The options are as follows: - **Server timezone**: Uses the Rocket.Chat server timezone for all workspace users. - **Custom timezone**: Uses a specific timezone that you select for all workspace users. - **User's current timezone**: Uses each user's own timezone. | | **Custom timezone** | If you select **Custom timezone** as the default timezone, select the timezone of your choice from the drop-down menu. If you select any other option, this setting is disabled. | --- ## Iframe integration In the **General** settings, expand the **Iframe Integration** section. > [!WARNING] > - For details on configuring iframes, see [Iframe Integration](https://developer.rocket.chat/docs/customize-and-embed-iframe-integration). > - To use the microphone, camera, and geolocation in an iframe, allow them in [the iframe features policy](https://developer.mozilla.org/en-US/docs/Web/API/FeaturePolicy). For example, > > ```xml > > ``` | Field | Description | | --- | --- | | **Enable Send** | Enable this setting to allow Rocket.Chat to send events to the parent window. | | **Send Target Origin** | Enter the origin, with protocol prefix, that commands are sent to. Example: `https://localhost`. Use `*` to allow sending to any origin. | | **Enable Receive** | Enable this setting to allow a parent window to send commands to Rocket.Chat. | | **Receive Origins** | Enter the origins, with protocol prefix and separated by commas, that are allowed to send commands. Example: `https://localhost, http://localhost`. Use `*` to allow receiving from any origin. | Select **Restore defaults** to revert the settings in this section to their default values. --- ## Notifications In the **General** settings, expand the **Notifications** section. - **Max Room Members Before Disabling All Message Notifications**: Enter the maximum number of room members before notifications for all messages are disabled. Users can still change the per-room setting to receive all notifications individually. Enter `0` to disable this limit. The default value is `100`. --- ## NPS In the **General** settings, expand the **NPS** section. - **Enable NPS Survey**: Enable this setting to run the NPS survey for all users. Administrators receive an alert two months before the survey is launched. For more details, see [Net Promoter Score (NPS) survey](/docs/net-promoter-score-nps-survey). --- ## SSRF protection > [!NOTE] > **The SSRF protection setting is available in version** [**8.2.0**](/v1/docs/rocketchat-release-notes#release-820) **and later.** A server-side request forgery (SSRF) vulnerability allows an attacker to force a server to send requests to any domain or IP address of their choosing. In Rocket.Chat's case, an attacker could craft a malicious URL (for example, in a webhook or message preview) that tricks the server into making requests to cloud metadata services, exposing API keys, credentials, and other internal data. By default, Rocket.Chat's outbound HTTP requests are automatically screened to defend against SSRF attacks. Before any connection is allowed, the destination URLs are resolved and checked against a blocklist of restricted IPs and private network ranges. > [!WARNING] > A few trusted outbound HTTP requests are not scanned by Rocket.Chat. This is because the URLs are either hardcoded or can only be defined by a workspace admin. In the **General** settings, expand the **SSRF protection** section and update the following option only if you want to allow specific domains or IPs: | Field | Description | | --- | --- | | **SSRF allowlist** | Enter the domains, IPs, or IP:port values that are allowed for outbound requests despite SSRF protection. Enter one value per line, or separate values with commas. Use this field only for trusted internal hosts. Examples: `internal.corp`, `192.168.1.1`, `192.168.1.1:8080` | By default, Rocket.Chat implements multiple security layers as follows. This is only for your information, and no further action is required: - **Block internal IP ranges**: Restricts all private IP ranges and internal cloud service IPs. - **Protocol restrictions**: Allows only HTTP and HTTPS, blocking schemes such as `gopher://`, `ftp://`, and `file://`, which could be used to read local files or reach internal services. - **Validate redirects**: Prevents attackers from registering an unblocked domain that redirects to a blocked IP or domain. For example, this prevents `evil.io` from redirecting to the metadata service at `169.254.169.254`. - **Domain lookups**: Resolves domain names to their IP addresses and blocks those that point to restricted IP addresses, preventing attackers from registering domains that resolve to internal addresses. - **Block different IP formats**: Considers different representations of the same address. For example, `localhost` can be written as `127.0.0.1`, `[::1]`, `2130706433` (decimal), or `0177.0.0.1` (octal). To prevent SSRF validation bypasses, Rocket.Chat accepts only formats such as `127.0.0.1` and `[::1]`. --- ## Stream Cast ![](https://cdn.us.document360.io/6ae79a05-7252-45d0-96e8-8f375e07b1b2/Images/Documentation/Deprecated.svg) > [!WARNING] > **This feature is deprecated and will be removed in future versions.** If you are using Stream Cast, expand the **Stream Cast** section in the **General** settings. - **Stream Cast Address**: Enter the IP or host of your Rocket.Chat central Stream Cast. Example: `192.168.1.1:3000` or `localhost:4000` --- ## Update In the **General** settings, expand the **Update** section to modify your workspace's update checker settings. | Field | Description | | --- | --- | | **Update Latest Available Version** | Displays the latest available version. | | **Enable the Update Checker** | Enable this setting to receive new update notifications and important messages from Rocket.Chat developers. The notification appears once per new version as a clickable banner and as a message from the Rocket.Cat bot, both visible only to administrators. | Select **Restore defaults** to revert the settings in this section to their default values. --- ## UTF8 In the **General** settings, expand the **UTF8** section to configure the name validation rules for usernames and rooms. If you are having problems with names when creating channels, such as when using non-English characters, adjusting these values usually resolves it. For example, using `[\w_-]+` allows any non-space character to be part of a name. | Field | Description | | --- | --- | | **UTF8 Usernames Validation** | Enter the regular expression used to validate usernames. The default value is `[0-9a-zA-Z-_.]+`. **Example:** To allow Japanese strings, enter the regex `[぀-ゟ゠-ヿーa-zA-Zａ-ｚＡ-Ｚ0-9一-鿿-０-９-、。_.]+`. This allows you to create usernames containing Japanese characters; avatars are displayed using the first character. | | **UTF8 Channel Names Validation** | Enter the regular expression used to validate channel names. The default value is `[0-9a-zA-Z-_.]+`. Example: To allow Japanese strings, enter the regex `[぀-ゟ゠-ヿーa-zA-Zａ-ｚＡ-Ｚ0-9一-鿿-０-９-、。_.]+`. This allows you to create channels containing Japanese characters; channel avatars are displayed using the first character. | | **UTF8 Names Slugify** | Enable this setting to create slugs for names. | Select **Restore defaults** to revert the settings in this section to their default values. --- ## Apps In the **General** settings, expand the **Apps** section. | Field | Description | | --- | --- | | **Apps' Source Package Storage type** | Select where the apps' source code is stored. Each app can be multiple megabytes in size. The options are **GridFS** and **FileSystem.** > [!WARNING] > Changing where the apps are stored may cause instabilities in apps that are already installed. | | **Directory for storing apps source package** | Enter the absolute path in the filesystem for storing the apps' source code (in `.zip` file format). This field is available only when **FileSystem** is selected as the storage type. Make sure the directory exists and Rocket.Chat has read and write access to it. |