example-petstore.com

Example domain · Not a live service · Browser visits show this page · API requests get 410 Gone

Example domain · not a real service

example-petstore.com

example-petstore.com is an example domain from Google’s documentation on Google Analytics, Search Console and structured data, where it stands in for your own website. It hosts no shop, no API and no search. If this name appears in your code or settings, replace it with your own domain.

Sent a key, token or password here? Rotate it now.

Requests from code that points at example-petstore.com reach this server instead of the real service, including any API key, access token, password or session cookie they carry. Treat those credentials as exposed:

  1. Revoke the key, token or password at the service that issued it.
  2. Issue a new one and keep it in configuration or a secrets manager, not in code.
  3. Correct the address in your code, so new credentials only go to the real service.
  4. Review that service’s access logs for activity you do not recognise.

Where to revoke keys at GitHub, AWS, Google Cloud, Stripe and others

Find the right guide

Every guide covers one task. Pick the group that matches where you found this domain.

Fix your site settings

Analytics, structured data and Search Console settings copied from Google’s examples.

Google Analytics · Tag Manager

From Classic Analytics to Google Analytics 4

Remove _setDomainName, _link and _linkByPost code, install the Google tag, and set up cross-domain measurement and unwanted referrals the current way.

Search Console

Moving a site in Search Console

A complete site move with 301 redirects and the Change of Address tool, without example addresses in canonicals, sitemaps or hreflang.

Develop and test

API clients, mock servers and example values that never reach a stranger’s server.

APIs · SDKs

Configuring API clients and SDKs

Keep base URLs out of code, point them at the real service, and add a check that stops example addresses from reaching production.

APIs · OpenAPI

Looking for the Swagger Petstore?

The real base URLs of the Swagger Petstore sample API, working requests, the test key, and how to run your own copy with Docker.

Security

When a key, token or password was sent here or committed to Git.

Security

Leaked credentials: what to do now

Keys, tokens or passwords were sent to an example domain. Revoke and replace them, with direct links to the revocation pages of common providers.

Security · Git

Removing a secret from Git history

A key was committed. Revoke it, remove it from the history with git-filter-repo, clean up GitHub and block the next leak.

Background

Where the name comes from, which names are reserved, and the terms used on this site.

Reference

Example domains

Which names are reserved for documentation, why look-alikes like this one get real traffic, and what to use instead.

Reference

Glossary

Short explanations of _setDomainName, linker, _gl, unwanted referrals, SearchAction and 410 Gone.

All guides on one page

Where this name comes from

Each example below shows the outdated snippet as it was published, and what to use instead. The highlighted part is what you replace. The full history has dates and archived sources.

Google Analytics · 2009–2024

Cross-domain tracking with Classic Analytics

Google’s guide to tracking multiple domains with Classic Analytics (ga.js) used a pet store at example-petstore.com, subdomains such as dogs.example-petstore.com, and a shopping cart at example-commerce-host.com.

Outdated example

_gaq.push(['_setAccount', 'UA-12345-1']);
_gaq.push(['_setDomainName', 'example-petstore.com']);
_gaq.push(['_setAllowLinker', true]);

<a href="http://dogs.example-petstore.com/intro.html"
   onclick="_gaq.push(['_link', 'http://dogs.example-petstore.com/intro.html']); return false;">See my pet store</a>

Classic and Universal Analytics no longer collect data. Remove this code, including the example links, and install the Google tag for Google Analytics 4. Cross-domain measurement is then set in the admin.

Use instead

<!-- Google tag (gtag.js) for Google Analytics 4 -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXXXX');
</script>

Full guide: from Classic Analytics to Google Analytics 4

Search Console · 2015–2019

Moving a site

Search Console’s help on the Change of Address tool used a move from http://fish.example-petstore.com to http://example.com or http://example-petstore.com. The tool only works between domain-level properties (a Domain property or a root URL-prefix property such as https://example.com/) owned by the same Google account, so the example addresses must be replaced with your own, including in canonicals, sitemaps and hreflang.

Full guide: moving a site in Search Console

APIs · scripts

API clients and scripts

Requests to addresses such as api.example-petstore.com/v2/pet come from code that uses this domain as a base URL. They receive 410 Gone with a JSON explanation. This domain is not related to the Swagger Petstore sample API at petstore.swagger.io.

Use instead: read the address from configuration

# Python: read the address from configuration, not from the code
import os
BASE_URL = os.environ["API_BASE_URL"]

// JavaScript / Node.js
const baseURL = process.env.API_BASE_URL;

// PHP 8
$baseUrl = getenv('API_BASE_URL') ?: throw new RuntimeException('API_BASE_URL is not set');

Full guide: configuring API clients and SDKs

Quick checklist

  • Search your code, templates, theme and tag manager for example-petstore and example-commerce-host.
  • Remove Classic and Universal Analytics code; in Google Analytics 4, list only your own domains.
  • Use your own home page and site name in structured data, and check it with the Schema Markup Validator.
  • Point API clients and scripts at the real service, and rotate any credentials that were sent here.
  • When everything points at the right place, nothing from your site or code reaches this domain.

At a glance: fixes per platform

WhereWhat you seeWhat to do
Classic Analytics (ga.js) or Universal Analytics (analytics.js)_setDomainName, _setAllowLinker, _link, _linkByPost, or ga('linker:autoLink', …) with one of these namesRemove the whole old snippet, including onclick/onsubmit handlers and the example links, and install the Google tag for Google Analytics 4. Standard Universal Analytics properties stopped processing data on 1 July 2023 (360 properties on 1 July 2024). Universal Analytics has been replaced
Google Analytics 4These names in the domain list, or self-referrals in reportsAdmin › Data collection and modification › Data streams › your web stream › Configure tag settings › Configure your domains: keep only your own domains. Add stray referrers under List unwanted referrals. Set up cross-domain measurement
Google tag in code (gtag.js)gtag('set', 'linker', {'domains': ['example-petstore.com']}) or a hard-coded cookie_domainPut your own domains in linker.domains; leave cookie_domain out or set it to 'auto'. Measure activity across multiple domains
Google Tag ManagerDomain list in the Google tag, or an old Custom HTML tagGoogle tags › your tag › Show all › Configure your domains / List unwanted referrals; search Custom HTML tags and variables for the old snippet; test with Preview. Google tag settings in Tag Manager
Structured data you added yourself (JSON-LD, microdata)"url": "https://www.example-petstore.com/", a target on query. or host.example-petstore.comUse your own home page as url and your own site name as name. The SearchAction may go. Check with the Schema Markup Validator (the Rich Results Test does not cover site names). Site names in Google Search
Yoast SEOSearch action in the site schemaYoast uses your own site address. To remove it: add_filter( 'disable_wpseo_json_ld_search', '__return_true' ); Yoast: SearchAction
Rank MathSearch action in the site schemaRank Math uses your own site address. To remove it, use the filter rank_math/json_ld/disable_search. Rank Math: sitelinks search box schema
All in One SEOSearch action in the site schemaSearch Appearance › Advanced › “Enable Sitelinks Search Box” off. AIOSEO: sitelinks search box
SEOPress—The search box markup was removed in version 8.4 (December 2024); update the plugin. SEOPress changelog
Search ConsoleAn example address used in a site move, canonical, sitemap or hreflangChange of Address only works between domain-level properties (a Domain property or a root URL-prefix property) owned by the same Google account. Keep the 301 redirects for at least a year, preferably for good. Correct canonicals, sitemap and hreflang on your own site, then resubmit the sitemap. Change of Address tool
API clients, SDKs and scriptsA base URL or host on one of these names, often with an Authorization headerMove the base URL to configuration (environment variable or config file) and point it at the real service. Revoke every key that was sent here. OWASP Secrets Management

Find it in your own code

Search your project, including templates and theme files, for both names:

grep -rniE "example-(petstore|commerce-host)\.com" .

Also check what your code does not show: the rendered HTML of your home page (view source and search), the custom HTML tags and variables in your Google Tag Manager container, the “custom head code” fields of your CMS or theme, and the settings of your analytics and SEO plugins.

Questions and answers

What is example-petstore.com?

An example domain. Google’s documentation on Google Analytics, Search Console and structured data used it as a stand-in for your own website, and tutorials copied it from there. It hosts no shop, no API and no search.

Is example-petstore.com a real pet store?

No. Nothing is sold here and there are no products, accounts or orders. Every address on the domain shows this page.

Why do requests from my site or code arrive at example-petstore.com?

An address from an example was copied and never replaced: a link from an old tracking snippet, structured data, a Search Console setting or the base URL of an API client. Replace it with your own domain or the real service.

I sent an API key, token or password to example-petstore.com. What now?

Treat it as exposed. Revoke it at the service that issued it, issue a new one, keep it outside your code, correct the address and review the service’s access logs. Only the issuing service can revoke a key.

What did query.example-petstore.com do?

In Google’s 2014–2015 example for the sitelinks search box, it was the made-up address of the pet store’s search results page. Google could show a search box below a site’s result; the search terms replaced {search_term_string} and the searcher was sent to that address. It never existed, and Google stopped showing the search box in November 2024.

When was example-petstore.com first used?

In March 2009, when Google reorganised its Classic Analytics documentation and the guide to tracking multiple domains introduced the pet store and its cart. Earlier versions of that guide did not use it.

Is this related to the Swagger Petstore?

No. The Swagger Petstore is a sample API for OpenAPI at petstore.swagger.io. example-petstore.com comes from Google’s analytics and SEO documentation.

What is example-commerce-host.com?

The sister example domain: the third-party shopping cart in the same cross-domain examples, such as example-commerce-host.com/example-petstore. See example-commerce-host.com.

Sources