A site with a Content Security Policy

If your site sends a Content-Security-Policy header, the browser will block the tag until the policy allows it.

Add the Signalbox API host to two directives:

script-src  https://api.trysignalbox.com;
connect-src https://api.trysignalbox.com;

• script-src lets the page load signalbox.js, and the calendar and questions files when they are needed.
• connect-src lets the script send what it sees to Signalbox.

Keep whatever the directives already hold. Add the host; do not replace the list.

How to tell the policy is in the way

Open the browser’s developer tools on a page with a form and look at the console. A blocked script or call is reported there, with the directive that blocked it.

Styles

The calendar adds one small style block to the page when it opens. If your policy’s style-src does not allow inline styles, the calendar shows without its styling. Either allow them:

style-src 'self' 'unsafe-inline';

or tell us, and we will give you the calendar’s styles as a file to host yourself.

The questions step needs nothing: it is styled by your own site’s CSS.

Frames

No frame-src change is needed. Signalbox uses no frame of its own.