06 · Troubleshooting

Let the script through your Content Security Policy

A strict policy blocks scripts from addresses it doesn't list. Two additions let this one through.

01How it looks

The browser's console says it refused to load the script, or refused to connect to /api/event, because it violates the page's Content Security Policy. The live check keeps waiting.

02What to allow

Allow the script's address in script-src, and the same address in connect-src, where its events go. Add https://t.tallybyoutpost.com to the lists you already have; don't replace them:

Header

Content-Security-Policy: script-src 'self' https://t.tallybyoutpost.com; connect-src 'self' https://t.tallybyoutpost.com

Meta tag

<meta http-equiv="Content-Security-Policy" content="script-src 'self' https://t.tallybyoutpost.com; connect-src 'self' https://t.tallybyoutpost.com">

Next.js

// next.config.js: add the address to the policy you already send.
const policy = [
  "script-src 'self' https://t.tallybyoutpost.com",
  "connect-src 'self' https://t.tallybyoutpost.com",
].join('; ');

module.exports = {
  async headers() {
    return [{ source: '/(.*)', headers: [{ key: 'Content-Security-Policy', value: policy }] }];
  },
};

The script needs nothing else: no inline code, no eval, no styles, no frames.

03Through your own domain

When you serve the script from your domain, the script and its events are on your own address, which 'self' already allows.

04Check it worked

Something missing, or not what you see? Write to support@tallybyoutpost.com and say which page.