Content Security Policy (CSP)
If your site sends a Content-Security-Policy, allow https://app.asknudge.ai in script-src, connect-src and frame-src, and allow inline styles.
When you need this page
Only if your site sends a Content Security Policy (CSP), either as a Content-Security-Policy HTTP header or as a <meta http-equiv="Content-Security-Policy"> tag in the page. Without a policy, the widget needs nothing more than the snippet.
When Nudge detects a policy that blocks the widget, the install status shows Blocked by CSP, with the exact sources to add to each directive and a Copy all directives button.
One origin to allow
Everything the widget loads on your page comes from one origin: https://app.asknudge.ai. No CDN, no font host, no third-party domain is loaded on your page.
The directives
| Directive | Add | Why |
|---|---|---|
script-src | https://app.asknudge.ai | The snippet (/widget/loader.js) and the widget runtime it loads (/widget/r/…/runtime.js, or /widget/runtime.js). |
connect-src | https://app.asknudge.ai | The widget's settings, read on every page load, the available slots, and the visit signal Nudge uses to detect the installation. |
frame-src | https://app.asknudge.ai | The chat, the pop-up and the booking form open in an iframe. |
style-src | 'unsafe-inline' | The widget adds one <style> element to the page to position the bar and the pop-up. Without it, the widget loads but is not positioned. |
If a directive already exists in your policy, add the source to it. Do not replace your existing sources.
Which directive applies
Browsers fall back from the most specific directive to the most general one. The first one present in your policy is the one that counts, so that is where the source must go:
| Request | Directives checked, in order |
|---|---|
| Scripts | script-src-elem, then script-src, then default-src |
| Connections | connect-src, then default-src |
| Frames | frame-src, then child-src, then default-src |
| Styles | style-src-elem, then style-src, then default-src |
For example, if your policy has script-src-elem, adding Nudge to script-src changes nothing: add it to script-src-elem.
Example
A policy that allows Nudge, merged into a typical existing policy:
Content-Security-Policy:
default-src 'self';
script-src 'self' https://app.asknudge.ai;
connect-src 'self' https://app.asknudge.ai;
frame-src https://app.asknudge.ai;
style-src 'self' 'unsafe-inline'Merge these values into your own policy rather than copying this one: keep the sources your site already needs (analytics, fonts, payment…).
Special cases
Cloudflare Turnstile
The chat checks that it is talking to a real visitor with Cloudflare Turnstile. That check runs inside the Nudge iframe, under Nudge's own policy. Your site does not need to allow challenges.cloudflare.com for the widget. Only allow it if your own pages use Turnstile.
The same goes for everything else in the chat (fonts, images): it loads inside the iframe and does not depend on your policy.
Find your current policy
- Open your site, then your browser's developer tools.
- The Console names what is blocked: look for
Refused to load…,Refused to connect…orRefused to frame…messages that mentionapp.asknudge.ai. - The Network tab shows the page's response headers: look for
Content-Security-Policy. - The page source may contain a
<meta http-equiv="Content-Security-Policy">tag.
The header is usually set by your server, your host, a CDN or proxy in front of your site, or a security plugin. On Framer, see Content Security Policy on Framer.
Test without breaking anything
- Send the new policy as
Content-Security-Policy-Report-Onlyfirst. The browser reports what it would block, without blocking it. - Open a page with the widget and the console. Look for messages about
app.asknudge.ai. - No message left: switch the header back to
Content-Security-Policy.
The Nudge install check ignores Content-Security-Policy-Report-Only, since it blocks nothing.
Check again
Once your site is published with the new policy, click Re-check installation in Nudge. The status changes from Blocked by CSP to Live as soon as a page of your site has loaded the widget. See Verify the installation.