ESPHome applies its list of permitted websites to more of a device’s web interface, including firmware uploads, Prometheus metrics and the live event stream on ESP32. A browser page hosted elsewhere must be on that list to make those requests.
A read-only dashboard that uses the ESP32 event stream may need its site added to the existing allowed-origins setting. Dashboards that already have permission to control entities use the same list. Server-side scrapers and scripts that send no browser origin continue to work.