Skip to main content

Troubleshooting: Content Security Policy directive: frame-src 'self' error

Learn how to update your Content Security Policy (CSP) to allow UserWay Widget scripts, styles, fonts, media, API requests, and other required resources.

If the UserWay Accessibility Widget doesn't appear, its menu won't open, or a widget feature isn't working, your website's Content Security Policy (CSP) may be blocking a resource the widget needs.

A CSP controls which resources a website can load. If the browser reports an enforced CSP violation for a UserWay resource, allow https://*.userway.org in the directive named in the violation message, and keep the rest of your existing policy.

ℹ️ Note: Before you change your policy, confirm that the browser is reporting an enforced CSP violation. A missing or broken widget doesn't always mean there's a CSP problem.

Identify the Blocked Resource

  1. Open the affected page, then open your browser's Developer Tools (F12 on Windows/Linux, or Cmd + Option + I on macOS).

  2. Click the Console tab, then reload the page.

  3. Try to open the widget or use the feature that isn't working.

  4. Review any CSP violation messages. To narrow the results, filter for userway or cdn.userway.org.

  5. Note the blocked resource URL and the directive named in each message.

Review the Relevant Directive

CSP directives control different resource types:

Directive

Resource type

script-src

Scripts

style-src

Stylesheets

img-src

Images

connect-src

Requests made through script interfaces

font-src

Fonts loaded through @font-face

media-src

Resources loaded through audio and video elements

frame-src

Frames and iframes

Apply and Verify Changes

⚠️ Important: Have your website administrator or security team review each blocked resource before allowing it. Add UserWay sources to your existing policy, and don't replace your policy with a generic example.

  1. Add https://*.userway.org to the directive named in the violation message, in every enforced policy that blocks the resource.

  2. Deploy the updated policy.

  3. Reload the page and confirm the updated policy is being delivered.

  4. Open the widget and test the feature that wasn't working.

  5. Check the Console for any remaining CSP violations.

Expected Result

The UserWay Accessibility Widget loads, its menu opens, and the affected feature works with no CSP violations in the browser Console.


Need more help?

Contact the UserWay Support Team — we're here to assist you.

Get in touch with UserWay Support.

Did this answer your question?