Site Security Blocking the Widget

Some websites have a security setting that blocks outside content. Here's how to tell if yours does, and exactly what to ask for.

You've pasted your embed code, saved the page, and… nothing appears. No chat bubble, no error, just your page as it was before.

Nine times out of ten this is not a problem with your chatbot. It's a security setting on your own website called a Content Security Policy — a list of which outside services your site is allowed to load. If AI Bot Kit isn't on that list, your browser quietly refuses to show the widget.

The good news: it's a one-line change, and you almost certainly don't have to make it yourself.

---

How to tell if this is your problem

Open the page where the chatbot should be, then:

1. Right-click anywhere on the page and choose Inspect (on Safari you may need to turn on the Develop menu first).
2. Click the Console tab.
3. Reload the page.

If you see a red message mentioning "Content Security Policy", "frame-ancestors", "refused to frame" or "refused to load the script", that's it — your site is blocking us.

See nothing red at all? Then this page isn't your answer. Try Chatbot Not Showing instead.

---

What to send your web person

You don't need to understand the settings below — copy this section and send it to whoever manages your website, or paste it into your website builder's support chat. They will know what to do with it.

Our chat widget is served by AI Bot Kit and is being blocked by our Content Security Policy. Please allow https://app.aibotkit.io in these three directives:

• script-src — so the widget's script can load
• frame-src — so the chat window itself can appear
• connect-src — so the chat can send and receive messages

For example:

script-src  'self' https://app.aibotkit.io;
frame-src   'self' https://app.aibotkit.io;
connect-src 'self' https://app.aibotkit.io;

Add https://app.aibotkit.io to the existing lines rather than replacing them. Overwriting a Content Security Policy will break other things on your site — analytics, fonts, payment buttons.

---

Website builders

Most hosted builders don't let you set a Content Security Policy at all, which means there is nothing to fix — if your widget isn't showing on one of these, the cause is something else.

Platform	Can it block the widget?
Squarespace	No — nothing to change
Wix	No — nothing to change
Shopify	No, on standard themes
WordPress	Only if a security plugin adds one — see below
Webflow	Only on custom hosting setups
A site your own team built	Yes — send them the section above

On WordPress, a Content Security Policy usually comes from a security plugin such as Wordfence, iThemes Security or Really Simple SSL. Look in that plugin's settings for Content Security Policy or Headers, and add https://app.aibotkit.io there. Using our WordPress plugin instead of the pasted code does not get around this — the same setting blocks both.

---

What your visitors see

Nothing at all. There's no error message and no broken image — the widget simply isn't there, and the page looks completely normal.

That's worth knowing, because it means you cannot tell from the page itself that anything is wrong, and neither can your visitors. If your chat volume dropped to zero after a website change, this is the first thing to check.

---

Still stuck?

Send us the red message from the Console tab — the whole line, exactly as it appears. It names the specific setting that's blocking us, which tells us straight away what needs changing.

Contact support