How to Allow External Tool, Widgets and Scripts in Website?
Questions:
- Why did my live-chat box, pop-up, or booking widget disappear?
- How do I fix a marketing or tracking pixel that stopped working?
- Where do I add trusted external tool addresses in website?
Description:
What you notice: A tool from another company — a live-chat box, a booking or review widget, a pop-up, a marketing/tracking pixel — no longer appears or no longer works since the security protection was switched on.
Why this happens: Your shop now only allows content from sources it trusts (this is what keeps hackers' code out). The outside tool you added simply isn't on the trusted list yet, so your visitors' browsers turn it away — exactly as they would turn away an unknown tool. Nothing is broken; the tool just needs to be approved once.
Solution:
-
Navigate to Content security policies.
Go to the back office: System Configuration → Security Configuration → Content security policies.
-
Find the field called script src (this is the "trusted programs" list).
-
Add the web address of the company that provides the tool
- Your tool provider usually documents this – it looks like https://www.the-tool-company.com. You can also allow a whole company with https://*.the-tool-company.com.
- For example, most commonly used widgets and tools' URL look like this -> Calendly "www://calendly.com" (a Booking Widget Free Online Appointment Scheduling Software | Calendly) or Google Analytics "www.google-analytics.com/" (a widget for Tracking Data Analytics Tools & Solutions for Your Business - Google Analytics).
- Save and reload your shop. The tool should reappear.
Tips and Tricks:
Some tools also need to send or receive data — if it still doesn't fully work, also add the same address to the connect src field (see How to Unblock and Authorize External Connections?).
Pro-Tips:
Not sure what to enter? That's normal — the exact web address comes from the tool's provider. The easiest path:
- Ask the tool provider for their "Content Security Policy" or "allowed domains", or
- Hand this article to your web agency or our support team; they'll identify the address from your browser in a minute and add it.
Warnings:
-
Don't ask anyone to "turn the security off" or "allow everything" to make the tool work. That would remove the protection from your whole shop. Approving the one specific tool is the safe fix.
Note for your agency: The blocked source appears in the browser console as a script-src CSP violation. A module can register it in code with SecurityUtil::addAllowedSource("https://…", ["script", "connect"]) instead of relying on the per-instance whitelist.