Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware.
If you are using CSP on your website, you will need to add the following rules for Smartsupp live chat to work correctly:
We've broken the article into a few sections:
CSP v3 - strict, compatible with Google
Content-Security-Policy:
object-src 'none';
script-src 'nonce-{random}' 'strict-dynamic' 'unsafe-inline' https: http:;
base-uri 'self';
report-uri https://your-report-collector.example.com/
CSP v2
Content-Security-Policy:
connect-src:
wss://*.smartsupp.com
https://*.smartsupp.com
https://*.smartsuppchat.com
https://*.smartsuppcdn.com
font-src:
https://*.smartsuppcdn.com
media-src:
https://*.smartsuppcdn.com
img-src:
data:
https://*.smartsuppcdn.com
script-src:
'unsafe-inline'
https://*.smartsuppchat.com
https://*.smartsuppcdn.com
style-src:
'unsafe-inline'
https://*.smartsuppcdn.com
Changelog
Changelog 2020-04-17: Added following
connect-src:
https://*.smartsuppchat.com
https://*.smartsuppcdn.com
2020-09-22: Removed following
connect-src:
https://smartsupp-widget-161959.c.cdn77.org
font-src:
https://smartsupp-widget-161959.c.cdn77.org
media-src:
https://smartsupp-widget-161959.c.cdn77.org
img-src:
https://smartsupp-widget-161959.c.cdn77.org
script-src:
https://smartsupp-widget-161959.c.cdn77.org
style-src:
https://smartsupp-widget-161959.c.cdn77.org
What's next?
Will Smartsupp slow down my website? — how the chat script affects your page speed.
Why can’t I see the chat on my website? — what to check when the chat box doesn't show on your site.
Supported browsers — browsers and versions that work with Smartsupp.