If your website uses a Content Security Policy (CSP), your browser blocks content from any source your policy doesn't allow. When you install SatisMeter with the HTML snippet, add SatisMeter to your policy so the widget can load and show your surveys. This article lists the directives to update and shows an example policy.
In this article:
- Updating your policy for SatisMeter
- Allowing the inline snippet
- Example policy
- Troubleshooting a survey that doesn't show
- See also
Updating your policy for SatisMeter
Add these values to the directives in your Content-Security-Policy header or meta tag:
Note: SatisMeter doesn't need any fonts, images, or style sheets allowed. You don't need to change
font-src,img-src, orstyle-srcfor SatisMeter.
Allowing the inline snippet
The SatisMeter snippet runs inline on your page, so script-src must also allow it. Choose one of these options:
-
'unsafe-inline': Add
'unsafe-inline'toscript-src. This is the simplest option, but it allows all inline code on your page. -
A nonce: Add a
nonceattribute to the snippet's<script>tag, and add the matching'nonce-…'value toscript-src. Generate a new nonce for each page load. -
A hash: Add a hash of the snippet's contents, such as a
'sha256-…'value, toscript-src. If you change the snippet, update the hash.
Example policy
This meta tag allows SatisMeter and uses 'unsafe-inline' for the snippet:
<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline' https://app.satismeter.com; connect-src 'self' https://app.satismeter.com;">If you use a nonce or a hash, replace 'unsafe-inline' with that value. Keep your existing directives for your other sources.
Troubleshooting a survey that doesn't show
If your survey still doesn't show after you update your policy, check your browser console for CSP errors that mention app.satismeter.com or the inline snippet. For more checks, see Survey not showing? Troubleshooting checklist.