Troubleshoot Enhanced Chat Setup

Refused to frame ‘<your 
ESW_[deploymentname] site>’ because an ancestor 
violates the following content security policy 
directive: “frame ancestors <your old domain> 
<your old subdomain>”

Change or add the domain that’s associated with your embedded service deployment.

• Go to Setup | User Interface | Sites and Domains | Sites.
• Select your site from the Site Label column. Your site is formatted as <ESW_[deploymentname]_[numbers]>.

• Under Trusted Domains for Inline Frames, find the domain or subdomain that you’d like to change, and click Edit.

• Save your changes.

 Access to XMLHttpRequest at 
'<your ESW_[deploymentname]_[numbers] site>' from 
directive: '<your domain>' has been blocked by CORS 
policy: No 'Access-Control-Allow-Origin' header is 
present on the requested resource.

Add your new domain to the CORS allowlist.

• From Setup, enter CORS in the Quick Find box, and then select CORS.
• Select New.

• Enter an origin URL pattern.

• Save your work.

Refused to load the script 
'<your ESW_[deploymentname]_[numbers]>/assets/js/
bootstrap.min.js' because it violates the 
following Content Security Policy directive: 
"scrtipt-src 'self ''unsafe-eval 'unsafe-inline'...". 
Note that 'script-src-elem' was not explicitly set, 
so 'script-src' is used as a fallback.

Add the ESW site as a trusted site within the Builder:

• Go to Setup | Digital Experiences | All Sites.
• Click Builder next to your experience cloud site.

• Under Settings, click Security & Privacy, and go to the Content Security Policy (CSP) section.

• Set Security level to Relaxed CSP: Permit Access to Inline Scripts and Allowed Hosts.

• Click Add Trusted Site to add the CSP trusted site details.

• Enter the name and URL of your esw site.

• Activate the site and click Add Site.

• Publish the site.

Add the ESW site as a Trusted URL in Setup:

• Go to Setup | Security | Trusted URLs.
• Click New Trusted URL.
• Fill out the API Name and URL fields.

• In the CSP Context field, select Experience Builder Sites.
• Under CSP Directives, select frame-src (iframe content) and style-src (stylesheets).

• Save your changes.

If you are using a third-party site to host your image, the site domain must be added as a Trusted URL:

• Go to Setup | | Security | | Trusted URLs.
• Click New Trusted URL.
• Fill out the API Name and URL fields.
• In the CSP Context field, select All.
• Under CSP Directives, select img-src (images).
• Save your changes.