Skip to content
SurveyRock Support

Content Security Policy for the website widget

If your site sends a Content Security Policy, allow the widget’s two hosts:

script-src https://media.surveyrock.com;
frame-src https://app.surveyrock.com;
  • script-src loads the widget and your site’s settings, both from media.surveyrock.com.
  • frame-src lets the survey open in the card, from app.surveyrock.com.

If your policy uses a nonce, put the same nonce attribute on the snippet’s <script> tags; the widget passes it on to the one script it adds. The widget adds no inline script or style attribute to your page: its card is drawn inside its own shadow root.

SurveyRock also checks the other direction: the survey page may only be framed by the domains on your Website, so a copied snippet doesn’t work on someone else’s site.

Setting up the widget for the first time? Start with Add the website widget to your site.