Skip to main content
All CollectionsYess Widget 🐚
Content Security Policies (CSP)
Content Security Policies (CSP)

Content Security Policies (CSP) are delivered as a header to your users' browser by your web-server.

Josh avatar
Written by Josh
Updated over a year ago

Content Security Policies (CSP) are delivered as a header to your users' browser by your web-server. They are used to declare which dynamic resources are allowed to load on your page.

For many websites, this often involves declaring that only scripts and styles from your own domain and that of any tools that you are using are allowed. However, this can become more involved when complex setups are in play.

If you identify CSP errors on your site that are similar to what is shown below, then your development team or hosting provider will need to adjust your CSP settings.

Adjusting your CSP settings

  1. Check to see if there are CSP errors.
    If you're seeing issues with Yess Widget, this can sometimes be caused by a CSP error. You can check your browser's developer console for these errors. You can learn how to open the console by following the steps in this guide.

  2. Consult with your web developer or hosting provider to adjust CSP settings.
    Since all servers are different, Hotjar's Support team won't be able to help troubleshoot these issues beyond identifying whether there's a CSP error. When making changes to your Content Security Policies, the best person to reach out to is your web developer, or whoever manages your website.

  3. Choose which CSP settings to adjust.
    If you are using a default CSP then adding the below to your default-src rules will be sufficient.
    ​
    The "..." in the examples below is a placeholder for any existing rules you might have in place:

    default-src ... https://*.yess.io 'unsafe-inline'


    If you want stricter restrictions we would recommend the template below to ensure that your policies will be more future-proof as we expand our services. Here's an example of what that would look like:

    img-src ... https://*.yess.io 
    script-src ... https://*.yess.io 'unsafe-inline' 
    connect-src ... https://*.yess.io 
    font-src ... https://*.yess.io 
    style-src ... https://*.yess.io 'unsafe-inline'


    If your CSPs require more granularity then here are the absolute minimum security allowances that you need to add to your web-server to allow Hotjar to function properly on your site:

    img-src ... https://assets.yess.io 
    script-src ... https://cdn.yess.io 'unsafe-inline' 
    connect-src ... https://*.yess.io 
    font-src ... https://*.yess.io 
    style-src ... https://cdn.yess.io 'unsafe-inline'
Did this answer your question?