Skip to content
New

Announcement placeholder — product sites pass real copy via the announcement prop.

Learn more →

Blocked by Content Security Policy

Your site has a Content Security Policy that blocks scripts from domains it does not know, and ours is one of them.

The short answer

Your site has a Content Security Policy that blocks scripts from domains it does not know, and ours is one of them. Add *.elfsight.com to the allowed script sources and the widget loads.

The console message begins *Refused to load the script because it violates the following Content Security Policy directive*.

Confirming it is CSP

Open the browser console — F12 on Windows, Cmd+Option+J on a Mac — and reload. A CSP block produces a red message naming the directive that rejected the script, usually script-src. If you see that, this is your problem and nothing else is.

The fix

Add our domain to the relevant directives in your policy. Where the policy lives depends on your stack: a Content-Security-Policy header from the server, a meta tag in the page head, or a security plugin. Add *.elfsight.com to script-src, and to connect-src and img-src if those are also restricted.

If you do not control the policy

On managed hosting or behind a corporate proxy, the policy may not be yours to change. Whoever administers it needs the domain added — that is the whole request, and it is a routine one.

Questions

Other common problems

Works in one browser but not another

If the widget appears in one browser and not another, or works in incognito but not normally, a browser extension is blocking it — usually an ad blocker or a privacy extension..