Course Player IT Allowlist
Allowing CFI's Course Player on your corporate network
If your learners see a blank Course Player, videos that won't load, or missing PDFs and exercises, your network is likely blocking one or more of the domains CFI relies on. Share this article with your IT or network security team so they can allow the domains below.
Before you start
- Allow outbound HTTPS (TCP 443) to every domain listed in this article.
- Use domain-based rules, not IP addresses. CFI's video provider, JW Player, runs on a dynamic content-delivery network and does not publish a static IP list.
- How wildcards work: a rule written as
*.example.comcoversexample.comand every subdomain of it (for examplea.example.comanda.b.example.com). Enter it using your firewall or proxy product's own wildcard syntax, since products differ.
Step 1: Allow the core domains (required)
Every learner needs these, regardless of which courses they take.
| Domain | What it's used for |
|---|---|
corporatefinanceinstitute.com |
CFI website and shared entry points |
learn.corporatefinanceinstitute.com |
Learner app and lesson pages |
api.corporatefinanceinstitute.com |
Lesson data, progress tracking, transcripts, and file/PDF access |
static.corporatefinanceinstitute.com |
Interactive exercises, PDFs, audio, and images |
resources.corporatefinanceinstitute.com |
Protected lesson downloads |
*.jwplayer.com |
Video player engine and licensing |
*.jwplatform.com |
Video player engine and media metadata |
*.jwpcdn.com |
Video player engine and script delivery |
*.jwpsrv.com |
Video and audio playback, captions, and thumbnails |
Recommended: for full coverage of JW Player's network, also allow *.jwpltx.com (player telemetry) and *.mux.com (an alternate video CDN JW Player may use in some regions). Both are on JW Player's own firewall list.
Already allow other CFI links? If your organization allows business.corporatefinanceinstitute.com or learning.corporatefinanceinstitute.com , keep those rules in place.
Step 2: Allow domains for embedded course content (as needed)
Some courses embed content from third-party tools. Add the domains for the content types your learners use. To support every current CFI course, add all of them.
| Course content | Domains to allow |
|---|---|
| Polls (Opinion Stage) | *.opinionstage.com , opinionstage-res.cloudinary.com |
| Form-based exercises (Typeform) | *.typeform.com |
| Interactive content (Visme) | *.visme.co |
| Blockchain exercise | guggero.github.io , use.fontawesome.com |
| Johari window exercise | kevan.org |
| Embedded videos (Wistia) | *.wistia.com , *.wistia.net , *.wistia.land , embedwistia-a.akamaihd.net , *.akamaized.net |
| Embedded videos (YouTube) | *.youtube.com , *.googlevideo.com , *.ytimg.com , *.ggpht.com , jnn-pa.googleapis.com , ssl.gstatic.com , fonts.gstatic.com |
| Public report embeds (Microsoft Power BI) | *.powerbi.com , content.powerapps.com , *.analysis.windows.net , *.pbidedicated.windows.net , *.blob.core.windows.net , *.cdn.office.net , *.virtualearth.net , bing.com , www.bing.com , platform.bing.com , r.bing.com |
| Workbook embeds (OneDrive / Excel Online) | onedrive.live.com , my.microsoftpersonalcontent.com , *.officeapps.live.com , *.cdn.office.net , res.public.onecdn.static.microsoft , p.sfx.ms |
Step 3: Allow supporting application domains (recommended)
These aren't video dependencies, but blocking them can break sign-in, fonts and icons, or the cookie-consent banner.
| Domains | What it's used for |
|---|---|
challenges.cloudflare.com |
Sign-in security check |
fonts.googleapis.com , fonts.gstatic.com , kit.fontawesome.com , ka-p.fontawesome.com , use.fontawesome.com , use.typekit.net , p.typekit.net , www.gstatic.com |
Fonts and icons |
cdn-cookieyes.com , directory.cookieyes.com , log.cookieyes.com |
Cookie-consent banner |
beacon-v2.helpscout.net |
In-app support widget (only if your learners use it) |
What this list doesn't cover
- Marketing, advertising, and analytics domains. You may see tracking or experimentation tools in a browser capture of CFI traffic. They aren't needed for the Course Player, so your security team doesn't need to allow them.
- Microsoft or Power BI embeds that require a learner's own Microsoft sign-in. These depend on your organization's Microsoft tenant settings.
This list was validated against CFI's live course catalog and production traffic. We'll update it when our catalog or video and content providers change.
Still having trouble?
If a learner still sees a blank or broken Course Player after these rules are in place:
- On the affected machine, find the first blocked request (for example, in the browser's developer tools or your proxy logs).
- Note the hostname and the error.
- Send both to CFI Support at [email protected]. This is the fastest way for us to find any remaining gap.
For any other questions about these rules, contact CFI Support at [email protected].