---
title: "example-petstore.com: the example domain from Google’s docs"
description: "An example domain from Google Analytics and SEO documentation. Where it comes from, what to replace, and why to rotate credentials sent here."
url: https://example-petstore.com/
language: en
---

# example-petstore.com

example-petstore.com is an example domain from Google’s documentation on Google Analytics, Search Console and structured data, where it stands in for your own website. It hosts no shop, no API and no search. If this name appears in your code or settings, replace it with your own domain.

## Sent a key, token or password here? Rotate it now.

Requests from code that points at example-petstore.com reach this server instead of the real service, including any API key, access token, password or session cookie they carry. Treat those credentials as exposed:

1. Revoke the key, token or password at the service that issued it.
2. Issue a new one and keep it in configuration or a secrets manager, not in code.
3. Correct the address in your code, so new credentials only go to the real service.
4. Review that service’s access logs for activity you do not recognise.

[Where to revoke keys at GitHub, AWS, Google Cloud, Stripe and others](https://example-petstore.com/guides/leaked-credentials)

## Find the right guide

Every guide covers one task. Pick the group that matches where you found this domain.

### Fix your site settings

Analytics, structured data and Search Console settings copied from Google’s examples.

#### [From Classic Analytics to Google Analytics 4](https://example-petstore.com/guides/google-analytics-cross-domain)

Remove `_setDomainName`, `_link` and `_linkByPost` code, install the Google tag, and set up cross-domain measurement and unwanted referrals the current way.

#### [The sitelinks search box and site names](https://example-petstore.com/guides/sitelinks-search-box)

What the search box markup with `query.example-petstore.com` did, why Google dropped it, and the `WebSite` markup to use today.

#### [Moving a site in Search Console](https://example-petstore.com/guides/change-of-address)

A complete site move with 301 redirects and the Change of Address tool, without example addresses in canonicals, sitemaps or `hreflang`.

### Develop and test

API clients, mock servers and example values that never reach a stranger’s server.

#### [Configuring API clients and SDKs](https://example-petstore.com/guides/api-base-url)

Keep base URLs out of code, point them at the real service, and add a check that stops example addresses from reaching production.

#### [Test against a mock API, not a placeholder](https://example-petstore.com/guides/mock-api)

Develop and test against Prism, WireMock, MSW or json-server instead of an address that belongs to someone else.

#### [Looking for the Swagger Petstore?](https://example-petstore.com/guides/swagger-petstore)

The real base URLs of the Swagger Petstore sample API, working requests, the test key, and how to run your own copy with Docker.

#### [Example values that are safe to use](https://example-petstore.com/guides/example-values)

Reserved domains, IP ranges, AS numbers, MAC addresses, phone numbers and test cards for examples that stay harmless.

### Security

When a key, token or password was sent here or committed to Git.

#### [Leaked credentials: what to do now](https://example-petstore.com/guides/leaked-credentials)

Keys, tokens or passwords were sent to an example domain. Revoke and replace them, with direct links to the revocation pages of common providers.

#### [Removing a secret from Git history](https://example-petstore.com/guides/remove-secrets-from-git)

A key was committed. Revoke it, remove it from the history with git-filter-repo, clean up GitHub and block the next leak.

### Background

Where the name comes from, which names are reserved, and the terms used on this site.

#### [The history of example-petstore.com](https://example-petstore.com/history)

When and where Google used example-petstore.com and example-commerce-host.com, from 2009 to today, with archived sources.

#### [Example domains](https://example-petstore.com/example-domains)

Which names are reserved for documentation, why look-alikes like this one get real traffic, and what to use instead.

#### [Glossary](https://example-petstore.com/glossary)

Short explanations of `_setDomainName`, linker, `_gl`, unwanted referrals, SearchAction and 410 Gone.

[All guides on one page](https://example-petstore.com/guides)

## Where this name comes from

Each example below shows the outdated snippet as it was published, and what to use instead. The highlighted part is what you replace. [The full history](https://example-petstore.com/history) has dates and archived sources.

### Cross-domain tracking with Classic Analytics

Google’s guide to tracking multiple domains with Classic Analytics (`ga.js`) used a pet store at example-petstore.com, subdomains such as dogs.example-petstore.com, and a shopping cart at [example-commerce-host.com](https://example-commerce-host.com/).

Outdated example

```
_gaq.push(['_setAccount', 'UA-12345-1']);
_gaq.push(['_setDomainName', 'example-petstore.com']);
_gaq.push(['_setAllowLinker', true]);

<a href="http://dogs.example-petstore.com/intro.html"
   onclick="_gaq.push(['_link', 'http://dogs.example-petstore.com/intro.html']); return false;">See my pet store</a>
```

Classic and Universal Analytics no longer collect data. Remove this code, including the example links, and install the Google tag for Google Analytics 4. Cross-domain measurement is then set in the admin.

Use instead

```
<!-- Google tag (gtag.js) for Google Analytics 4 -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-XXXXXXXXXX');
</script>
```

[Full guide: from Classic Analytics to Google Analytics 4](https://example-petstore.com/guides/google-analytics-cross-domain)

### Sitelinks search box markup

Google’s first examples for the sitelinks search box were copied into themes, forum software and SEO guides. query.example-petstore.com was the made-up address of the pet store’s search results page.

Outdated example

```
{
  "@context": "https://schema.org",
  "@type": "WebSite",
  "url": "https://www.example-petstore.com/",
  "potentialAction": {
    "@type": "SearchAction",
    "target": "https://query.example-petstore.com/search?q={search_term_string}",
    "query-input": "required name=search_term_string"
  }
}
```

The first version (September 2014) used `https://host.example-petstore.com/search?q={search_term}`. Google stopped showing the sitelinks search box on 21 November 2024; leftover markup causes no errors, but the `url` should be your own. A plain `WebSite` block still helps with your site name in search results.

Use instead

```
<script type="application/ld+json">
{
  "@context": "https://schema.org",
  "@type": "WebSite",
  "name": "Your site name",
  "url": "https://www.example.com/"
}
</script>
```

[Full guide: the sitelinks search box and site names](https://example-petstore.com/guides/sitelinks-search-box)

### Moving a site

Search Console’s help on the Change of Address tool used a move from `http://fish.example-petstore.com` to `http://example.com` or `http://example-petstore.com`. The tool only works between domain-level properties (a Domain property or a root URL-prefix property such as `https://example.com/`) owned by the same Google account, so the example addresses must be replaced with your own, including in canonicals, sitemaps and `hreflang`.

[Full guide: moving a site in Search Console](https://example-petstore.com/guides/change-of-address)

### API clients and scripts

Requests to addresses such as `api.example-petstore.com/v2/pet` come from code that uses this domain as a base URL. They receive `410 Gone` with a JSON explanation. This domain is not related to the Swagger Petstore sample API at [`petstore.swagger.io`](https://example-petstore.com/guides/swagger-petstore).

Use instead: read the address from configuration

```
# Python: read the address from configuration, not from the code
import os
BASE_URL = os.environ["API_BASE_URL"]

// JavaScript / Node.js
const baseURL = process.env.API_BASE_URL;

// PHP 8
$baseUrl = getenv('API_BASE_URL') ?: throw new RuntimeException('API_BASE_URL is not set');
```

[Full guide: configuring API clients and SDKs](https://example-petstore.com/guides/api-base-url)

## Quick checklist

- Search your code, templates, theme and tag manager for `example-petstore` and `example-commerce-host`.
- Remove Classic and Universal Analytics code; in Google Analytics 4, list only your own domains.
- Use your own home page and site name in structured data, and check it with the Schema Markup Validator.
- Point API clients and scripts at the real service, and rotate any credentials that were sent here.
- When everything points at the right place, nothing from your site or code reaches this domain.

## At a glance: fixes per platform

| Where | What you see | What to do |
| --- | --- | --- |
| Classic Analytics (`ga.js`) or Universal Analytics (`analytics.js`) | `_setDomainName`, `_setAllowLinker`, `_link`, `_linkByPost`, or `ga('linker:autoLink', …)` with one of these names | Remove the whole old snippet, including onclick/onsubmit handlers and the example links, and install the Google tag for Google Analytics 4. Standard Universal Analytics properties stopped processing data on 1 July 2023 (360 properties on 1 July 2024). [Universal Analytics has been replaced](https://support.google.com/analytics/answer/11583528) |
| Google Analytics 4 | These names in the domain list, or self-referrals in reports | Admin › Data collection and modification › Data streams › your web stream › Configure tag settings › **Configure your domains**: keep only your own domains. Add stray referrers under **List unwanted referrals**. [Set up cross-domain measurement](https://support.google.com/analytics/answer/10071811) |
| Google tag in code (`gtag.js`) | `gtag('set', 'linker', {'domains': ['example-petstore.com']})` or a hard-coded `cookie_domain` | Put your own domains in `linker.domains`; leave `cookie_domain` out or set it to `'auto'`. [Measure activity across multiple domains](https://developers.google.com/tag-platform/devguides/cross-domain) |
| Google Tag Manager | Domain list in the Google tag, or an old Custom HTML tag | Google tags › your tag › Show all › Configure your domains / List unwanted referrals; search Custom HTML tags and variables for the old snippet; test with Preview. [Google tag settings in Tag Manager](https://support.google.com/tagmanager/answer/12131703) |
| Structured data you added yourself (JSON-LD, microdata) | `"url": "https://www.example-petstore.com/"`, a `target` on `query.` or `host.example-petstore.com` | Use your own home page as `url` and your own site name as `name`. The `SearchAction` may go. Check with the Schema Markup Validator (the Rich Results Test does not cover site names). [Site names in Google Search](https://developers.google.com/search/docs/appearance/site-names) |
| Yoast SEO | Search action in the site schema | Yoast uses your own site address. To remove it: `add_filter( 'disable_wpseo_json_ld_search', '__return_true' );` [Yoast: SearchAction](https://developer.yoast.com/features/schema/pieces/searchaction/) |
| Rank Math | Search action in the site schema | Rank Math uses your own site address. To remove it, use the filter `rank_math/json_ld/disable_search`. [Rank Math: sitelinks search box schema](https://rankmath.com/kb/sitelinks-searchbox-schema/) |
| All in One SEO | Search action in the site schema | Search Appearance › Advanced › “Enable Sitelinks Search Box” off. [AIOSEO: sitelinks search box](https://aioseo.com/docs/how-to-get-google-to-display-the-sitelinks-search-box/) |
| SEOPress | — | The search box markup was removed in version 8.4 (December 2024); update the plugin. [SEOPress changelog](https://www.seopress.org/support/changelogs/seopress-free-pro/) |
| Search Console | An example address used in a site move, canonical, sitemap or hreflang | Change of Address only works between domain-level properties (a Domain property or a root URL-prefix property) owned by the same Google account. Keep the 301 redirects for at least a year, preferably for good. Correct canonicals, sitemap and hreflang on your own site, then resubmit the sitemap. [Change of Address tool](https://support.google.com/webmasters/answer/9370220) |
| API clients, SDKs and scripts | A base URL or host on one of these names, often with an `Authorization` header | Move the base URL to configuration (environment variable or config file) and point it at the real service. **Revoke every key that was sent here.** [OWASP Secrets Management](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html) |

## Find it in your own code

Search your project, including templates and theme files, for both names:

```
grep -rniE "example-(petstore|commerce-host)\.com" .
```

Also check what your code does not show: the rendered HTML of your home page (view source and search), the custom HTML tags and variables in your Google Tag Manager container, the “custom head code” fields of your CMS or theme, and the settings of your analytics and SEO plugins.

## Questions and answers

### What is example-petstore.com?

An example domain. Google’s documentation on Google Analytics, Search Console and structured data used it as a stand-in for your own website, and tutorials copied it from there. It hosts no shop, no API and no search.

### Is example-petstore.com a real pet store?

No. Nothing is sold here and there are no products, accounts or orders. Every address on the domain shows this page.

### Why do requests from my site or code arrive at example-petstore.com?

An address from an example was copied and never replaced: a link from an old tracking snippet, structured data, a Search Console setting or the base URL of an API client. Replace it with your own domain or the real service.

### I sent an API key, token or password to example-petstore.com. What now?

Treat it as exposed. Revoke it at the service that issued it, issue a new one, keep it outside your code, correct the address and review the service’s access logs. Only the issuing service can revoke a key.

### What did query.example-petstore.com do?

In Google’s 2014–2015 example for the sitelinks search box, it was the made-up address of the pet store’s search results page. Google could show a search box below a site’s result; the search terms replaced `{search_term_string}` and the searcher was sent to that address. It never existed, and Google stopped showing the search box in November 2024.

### When was example-petstore.com first used?

In March 2009, when Google reorganised its Classic Analytics documentation and the guide to tracking multiple domains introduced the pet store and its cart. Earlier versions of that guide did not use it.

### Is this related to the Swagger Petstore?

No. The Swagger Petstore is a sample API for OpenAPI at `petstore.swagger.io`. example-petstore.com comes from Google’s analytics and SEO documentation.

### What is example-commerce-host.com?

The sister example domain: the third-party shopping cart in the same cross-domain examples, such as `example-commerce-host.com/example-petstore`. See [example-commerce-host.com](https://example-commerce-host.com/).

## Sources

- [Measure activity across multiple domains](https://developers.google.com/tag-platform/devguides/cross-domain) Google Tag Platform
- [Tracking Multiple Domains (Classic Analytics, 2013 snapshot)](https://web.archive.org/web/20130115024413/https://developers.google.com/analytics/devguides/collection/gajs/gaTrackingSite) Google Developers via the Wayback Machine
- [Set up cross-domain measurement](https://support.google.com/analytics/answer/10071811) Google Analytics Help
- [Universal Analytics has been replaced by Google Analytics 4](https://support.google.com/analytics/answer/11583528) Google Analytics Help
- [Sitelinks search box (2015 snapshot)](https://web.archive.org/web/20150316142805/https://developers.google.com/structured-data/slsb-overview) Google Developers via the Wayback Machine
- [Farewell, Sitelinks Search Box](https://developers.google.com/search/blog/2024/10/sitelinks-search-box) Google Search Central Blog
- [Site names in Google Search](https://developers.google.com/search/docs/appearance/site-names) Google Search Central
- [Use the change of address tool (2015 snapshot)](https://web.archive.org/web/20150425234635/https://support.google.com/webmasters/answer/83106?hl=en) Search Console Help via the Wayback Machine
- [Change of Address tool](https://support.google.com/webmasters/answer/9370220) Search Console Help
- [Schema Markup Validator](https://validator.schema.org/) Schema.org
- [Swagger Petstore sample API](https://petstore.swagger.io/) Swagger