# Why isn't the widget loading on my site? (Content-Security-Policy)

**Category:** [Troubleshooting](https://help.totalctrl.app/hc/totalctrl/totalctrl-help-center/en-US/categories/troubleshooting-1)
**Updated:** 2026-08-19

## Symptoms

You pasted the embed snippet for the **AI Support Agent**, **Session Replay**, or **Platform Messaging** (Product Tours) onto your website, but:

- The button does nothing when clicked, or the widget never appears.
- Recordings or tours don't start.
- Your browser's developer console shows an error like *"Refused to load the script 'https://ds.totalctrl.app/…' because it violates the following Content-Security-Policy directive…"* or *"Refused to connect…"*.

## The cause: your site's Content-Security-Policy

All of our embeddable scripts are served from our embed domain, `https://ds.totalctrl.app`, and they call back to that same domain to load content and stream responses. If your website sends a **Content-Security-Policy (CSP)** header, the browser will block any script or connection to a domain that isn't on your allowlist — including ours.

This is a setting on *your* website, controlled by you (or your web team / platform), not something TotalCtrl can change for you. The fix is to add our embed domain to your CSP.
## The fix

Add `https://ds.totalctrl.app` to two CSP directives:

script-src  https://ds.totalctrl.app;
connect-src https://ds.totalctrl.app;

Merge these into your existing CSP rather than replacing it. For example, an existing policy might become:

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://ds.totalctrl.app;
  connect-src 'self' https://ds.totalctrl.app;

- **script-src** — lets the browser download our widget/SDK script.
- **connect-src** — lets the script fetch content and open its live (SSE) stream back to us.

After updating the header, reload your page with a hard refresh and the widget should appear.
## Good to know

- **Most sites don't have a CSP at all.** If yours doesn't, no changes are needed — the widget works out of the box.
- **TotalCtrl-hosted Help Centers** (including ones on your own custom domain) already allow our embed domain, so the agent works there automatically.
- If you use a custom embed domain configured for your account, allow that domain instead of `ds.totalctrl.app`.

## If it still doesn't work

Check these too:

- **Agent:** make sure the agent is set to **Live** (enabled), not Draft, and that the embed snippet's key matches your agent.
- **Allowed origins:** if you set an *Allowed origins* list on the agent or Session Replay site key, confirm the exact origin of the page (scheme + host) is on it. A missing or mismatched origin will block the widget even with a correct CSP.
- Look in the developer console for the precise error — a *CSP* message points to the fix above; an *origin not allowed* message points to your Allowed origins list.


---
[← Back to TotalCtrl Help Center](https://help.totalctrl.app/en-US/)