# A site with a Content Security Policy

> What to add to a Content Security Policy so the browser allows the tag.

If your site sends a `Content-Security-Policy` header, the browser will block the tag until the policy allows it.

Add the Signalbox API host to two directives:

```
script-src  https://api.trysignalbox.com;
connect-src https://api.trysignalbox.com;
```

- `script-src` lets the page load `signalbox.js`, and the calendar and questions files when they are needed.
- `connect-src` lets the script send what it sees to Signalbox.

Keep whatever the directives already hold. Add the host; do not replace the list.

## How to tell the policy is in the way

Open the browser's developer tools on a page with a form and look at the console. A blocked script or call is reported there, with the directive that blocked it.

## Styles

The calendar adds one small style block to the page when it opens. If your policy's `style-src` does not allow inline styles, the calendar shows without its styling. Either allow them:

```
style-src 'self' 'unsafe-inline';
```

or tell us, and we will give you the calendar's styles as a file to host yourself.

The questions step needs nothing: it is styled by your own site's CSS.

## Frames

No `frame-src` change is needed. Signalbox uses no frame of its own.