diff --git a/api.py b/api.py
index 7f61db6..5123da6 100644
--- a/api.py
+++ b/api.py
@@ -1492,7 +1492,7 @@ def create_server_api(**args):
 	if keyword!=secrets.SERVER_MASTER: jhtml(self,{"failed":1}); return
 	actual_ip=ip=self.request.remote_addr; server_name="XX"
 	if is_sdk: actual_ip=ip=domain.server_ip
-	if domain.https_mode: ip="%s.%s.%s"%(ip_to_subdomain.get(ip,ip),live_domain[1],live_domain[2])
+	if domain.https_mode: ip="%s.%s"%(ip_to_subdomain.get(ip,ip),live_domain)
 	lat,lon=(self.request.headers.get("X-Appengine-Citylatlong")or"0,0").split(",")
 	try: lat,lon=float(lat),float(lon)
 	except: lat,lon=0,0
diff --git a/config.py b/config.py
index 672afa0..24e1379 100644
--- a/config.py
+++ b/config.py
@@ -12,6 +12,7 @@ from lxml import etree as lxmletree
 import datetime as rdatetime
 import time as rtime
 from datetime import datetime,timedelta,date
+from urlparse import urlparse
 from google.appengine.api.users import is_current_user_admin
 from google.appengine.ext.webapp import blobstore_handlers # template,util,
 from google.appengine.api import memcache,urlfetch,urlfetch_errors,mail,taskqueue,images,files,namespace_manager,search,modules,logservice
@@ -103,25 +104,33 @@ always_amazon_ses=True
 SCREENSHOT_MODE=is_sdk and False
 game_name="Adventure Land"
 appengine_id="twodimensionalgame"
-live_domain=["www","adventure","land"]
-sdk_domain=["www","thegame","com"]
+live_domain='adventure.land'
+sdk_domain='thegame.com'
 SDK_UPLOAD_PASSWORD=ELEMENT_PASSWORD=secrets.sdk_password
 
 def gdi(self=None):
 	domain=GG()
 	if is_sdk:
-		domain.base_url=self and "http://%s"%self.request.headers.get("Host") or "http://%s.%s"%(sdk_domain[1],sdk_domain[2])
-		domain.pref_url=self and "http://%s"%self.request.headers.get("Host") or "http://%s.%s"%(sdk_domain[1],sdk_domain[2])
+		if self:
+			url=urlparse(self.request.url)
+			protocol=url.scheme
+			hostname=url.hostname
+		else:
+			protocol="http"
+			hostname=sdk_domain
+
+		domain.base_url=protocol + "://" + hostname
+		domain.pref_url=domain.base_url
 		domain.server_ip="192.168.1.125"
 		domain.stripe_pkey=stripe_pkey
 		domain.stripe_enabled=False
 		domain.https_mode=False
-		domain.domain=self and ["www",self.request.headers.get("Host").split(".")[0],self.request.headers.get("Host").split(".")[1]] or sdk_domain
+		domain.domain=hostname
 	else:
 		protocol="http"
 		if self and "https" in (self.request.headers.get("Cf-Visitor") or ""): protocol="https"
-		domain.base_url="%s://%s.%s"%(protocol,live_domain[1],live_domain[2])
-		domain.pref_url="https://%s.%s"%(live_domain[1],live_domain[2])
+		domain.base_url=protocol + "://" + live_domain
+		domain.pref_url=domain.base_url
 		domain.stripe_pkey=stripe_pkey
 		domain.stripe_enabled=False
 		domain.https_mode=HTTPS_MODE
diff --git a/functions.py b/functions.py
index 55e63b9..c0da97d 100644
--- a/functions.py
+++ b/functions.py
@@ -279,13 +279,12 @@ def selection_info(self,user,domain):
 def security_threat(self,domain):
 	referer=self.request.headers.get('Referer') or self.request.headers.get('Origin') or ""
 	if not referer: return False
-	referer=referer.replace("http://","").replace("https://","")
-	#referer="www.thegame2.com"
-	logging.info(referer)
-	if referer.startswith("127.0.0.1"): return False
-	if not (referer.startswith("%s.%s.%s/"%(domain.domain[0],domain.domain[1],domain.domain[2])) or referer.startswith("%s.%s/"%(domain.domain[1],domain.domain[2])) or referer=="%s.%s.%s"%(domain.domain[0],domain.domain[1],domain.domain[2]) or referer=="%s.%s"%(domain.domain[1],domain.domain[2])):
+
+	referer=urlparse(referer).hostname
+	if not referer.endswith(domain.domain):
 		self.response.out.write("Threat detected")
 		return True
+	
 	# if is_production and domain.cf_always_on and not is_cloudflare(self):
 	# 	conditional_response(self,domain,response,"cloudflare")
 	# 	st_log(self,"cloudflare")
@@ -1790,28 +1789,25 @@ def log_trace(place="",logger=None):
 	logger.error("\n\n<<<<<<<<<< log_trace %s %s>>>>>>>>>>"%(exc_type,place),exc_info=sys.exc_info())
 	logger.error("\n")
 
-def get_domain(self=None,url=None):
-	if self or url:
-		if self: url=self.request.url
-		try: url=url[0:url.index("/",8)+1] #in case the url doesn't end with / [25/09/15]
-		except: pass
-		url=url.replace("http://",""); url=url.replace("https://",""); url=url.replace("/",""); url=url.split(".")
-		if len(url)==2: return ["www",url[0],url[1]]
-		return [url[-3],url[-2],url[-1]] #to prevent the www.geobird.com.test.com-like url's [25/09/15]
+def get_domain(self=None):
+	if not is_sdk:
+		return live_domain
 	else:
-		if not is_sdk: return live_domain
-		else: return sdk_domain
+		if self:
+			return (urlparse(self.request.url)).hostname
+		else:
+			return sdk_domain
 
 def get_cookie(self,name):
 	return self.request.cookies.get(name)
 
 def set_cookie(self,name,value):
-	subdomain,domainname,toplevel=get_domain(self)
-	self.response.set_cookie(name,to_str(value),max_age=86400*365*5, path='/',domain='.%s.%s'%(domainname,toplevel),secure=secure_cookies)
+	hostname=get_domain(self)
+	self.response.set_cookie(name,to_str(value),max_age=86400*365*5, path='/',domain='.%s'%(hostname),secure=secure_cookies)
 
 def delete_cookie(self,name):
-	subdomain,domainname,toplevel=get_domain(self)
-	self.response.delete_cookie(name,path='/',domain='.%s.%s'%(domainname,toplevel))
+	hostname=get_domain(self)
+	self.response.delete_cookie(name,path='/',domain='.%s'%(hostname))
 
 class StrLogHandler(logging.Handler):
 	def __init__(self, output):