Fix a Content Security Policy that blocks the widget.
If your site sets a Content-Security-Policy, the browser can block the Zurvo widget. Allow app.zurvo.ai in three directives and the launcher appears.
Some websites send a security header called a Content-Security-Policy (CSP). It lists exactly which outside services the browser may load. When your site has one and Zurvo is not on the list, the browser blocks the widget and nothing appears — even though your install is correct.
Confirm this is the problem.
- Open your live site in a browser.
- Press F12 (or right-click → Inspect) and open the Console tab.
- Reload the page.
A blocked widget logs an error like this:
Loading the script 'https://app.zurvo.ai/widget.js' violates the following
Content Security Policy directive: "script-src 'self' ..."You can also open your Install Widget page in Zurvo and use Check my installation — it reads your site’s security policy and tells you whether it blocks the widget.
Allow Zurvo in three directives.
Add https://app.zurvo.ai to these three directives in your site’s Content-Security-Policy:
| Directive | Why the widget needs it |
|---|---|
script-src | Loads the widget script (widget.js) on your page. |
frame-src | Shows the chat window, which runs in a frame served by Zurvo. |
connect-src | Lets the widget report that it loaded, so your Install page shows a green status. |
A before-and-after example:
Before: script-src 'self'; frame-src 'self'; connect-src 'self'
After: script-src 'self' https://app.zurvo.ai; frame-src 'self' https://app.zurvo.ai; connect-src 'self' https://app.zurvo.aiNotes:
- If your policy has no
frame-src, the browser falls back tochild-src, thendefault-src. Addframe-src 'self' https://app.zurvo.aiso the frame is allowed no matter what the fallbacks say. - The policy can live in a response header or in a
<meta http-equiv="Content-Security-Policy">tag in your HTML. Update it wherever your site defines it. - Where you edit it depends on your setup: a Next.js site sets it in
next.config, many hosts set it in a dashboard or a server config file, and some security plugins add one for you.
After the change.
Deploy or save the change, then open your site in a private window and reload. The launcher should appear, and the console error is gone. Your Install Widget page’s status indicator turns green after the first load.
If the widget still does not appear, work through the checklist in Confirm the widget is loading on your site.