Skip to main content

Troubleshooting: Content Security Policy directive: frame-src 'self' error

Learn how to update your Content Security Policy (CSP) to allow UserWay Widget scripts, styles, fonts, media, API requests, and other required resources.

If the UserWay Accessibility Widget is not appearing or functioning correctly on your website, your Content Security Policy (CSP) may be preventing required UserWay resources from loading.​

Example CSP Error Message:

CSP is a browser security feature that controls which external resources a website is allowed to load. If our resources are blocked, the Widget may not load or some accessibility features may not function as expected.

Resources Used by the Widget

Our Widget may load external resources such as:

  • Scripts

  • Stylesheets

  • Images

  • API requests

  • Fonts

  • Media resources used by features such as Text-to-Speech

  • Widget iframe content

These resources must be permitted by your website's CSP configuration.

Update Your Content Security Policy

We recommend allowing UserWay resources using the following wildcard domain:

*.userway.org Depending on your existing CSP configuration, allow this domain in the following directives:

  • script-src

  • style-src

  • img-src

  • connect-src

  • font-src (for Dyslexia functional)

  • media-src (for Text-to-Speech functional)

  • frame-src

Example

script-src 'self' *.userway.org;
style-src 'self' *.userway.org;
img-src 'self' *.userway.org data:;
connect-src 'self' *.userway.org;
font-src 'self' *.userway.org;
media-src 'self' *.userway.org;
frame-src *.userway.org;

ℹ️ Note: Your exact CSP configuration may vary depending on your web server, hosting platform, and existing security policies.

Apply and Verify the Changes

  1. Save your updated CSP configuration.

  2. Deploy the changes to your website or server.

  3. Refresh the website.

  4. Confirm that the UserWay Widget loads and functions correctly.

Troubleshooting CSP Issues

If the Widget still does not load or a feature is not working:

  1. Open your browser's Developer Tools (F12).

  2. Select the Console tab.

  3. Look for Content Security Policy (CSP) violation messages.

  4. Identify any blocked UserWay resources.

  5. Update the relevant CSP directive as needed.

CSP violation messages usually identify the blocked resource and the directive responsible for blocking it, which can help determine what needs to be allowed.

Need More Help?

Contact the UserWay Support Team — we're here to assist you.

Get in touch with UserWay Support.

Did this answer your question?