Organizers Help Center
Home
🪩 General Set Up

Using the XCEED Widget on websites with a Content Security Policy

Edited

Some websites add an extra layer of security called a Content Security Policy (CSP). It is a list of the external websites your page is allowed to load content from. If your website has one, it must allow XCEED, otherwise your customers' browsers will block the widget.

If you don't know whether your website has a CSP, ask your web developer. Most websites don't have one, and in that case you don't need to do anything.

1. Check if the CSP is blocking XCEED

  • The widget appears, but no tickets are shown.

  • Customers can't log in or complete the payment.

2. Update your CSP

  • Send this article to your web developer.

  • Ask them to add the following sources to your website's existing CSP. They should add these, not replace what is already there:

- script-src  https://*.xceed.me https://www.googletagmanager.com

- connect-src https://*.xceed.me https://xceed.me https://checkoutshopper-live.adyen.com https://checkoutshopper-live.cdn.adyen.com https://checkoutanalytics-live.adyen.com

- img-src     https://*.xceed.me data: https://*.basemaps.cartocdn.com https://checkoutshopper-live.cdn.adyen.com

- style-src   https://*.xceed.me 'unsafe-inline'
- font-src    https://*.xceed.me data:
- frame-src   https://*.xceed.me https:

  • Save the changes and reload your widget page to check that tickets, login and payment work.


Important: always use https://*.xceed.me rather than listing individual XCEED addresses (such as offer.xceed.me). We update these addresses from time to time to improve our service, and a fixed list will stop the widget from working the day one of them changes. https://*.xceed.me covers all of them, now and in the future.

3. (For your web developer) If a payment method still fails
Open the browser console and look for an error starting with Refused to connect or Refused to load. It shows the blocked address, which should then be added to the CSP. Payment providers (Adyen, PayPal, Google Pay, Apple Pay, Klarna…) can use addresses of their own.

If you have any other questions check our FAQ page or contact support@xceed.me