Content Security Policy

If your web app uses Content Security Policy (CSP), you’ll need to ensure that your policy allows Userflow.js requests.

Your policy must allow the following:

connect-src:
  https://cdn.userflow.com
  https://e.userflow.com
  https://e.eu.userflow.com
  https://js.userflow.com
  wss://e.userflow.com
  wss://e.eu.userflow.com

script-src:
  https://cdn.userflow.com
  https://js.userflow.com

style-src:
  https://cdn.userflow.com
  https://js.userflow.com

img-src:
  https://blob.userflow.com
  https://cdn.userflow.com
  https://js.userflow.com
  https://storage.googleapis.com/studio1-prod-blob/

media-src:
  https://blob.userflow.com
  https://cdn.userflow.com
  https://storage.googleapis.com/studio1-prod-blob/

frame-src:
   https://cdn.userflow.com

Signs that something is blocking Userflow

If your policy is missing one of the domains above, you’ll usually see one of these:

• Userflow content doesn’t appear at all, or the installation check says Userflow.js isn’t loading.

• Your browser console shows an error like Refused to load… or Refused to connect… because it violates the following Content Security Policy directive, naming a userflow.com address.

• Content shows, but images or videos inside steps are broken. This usually means img-src or media-src is missing a domain.

To fix it, add the domain named in the error to the directive it mentions, then reload the page.

The same domains can be blocked outside your CSP. Corporate firewalls, proxies, DNS filters, and ad-blocking or privacy browser extensions can block them too. If Userflow works for some users or networks but not others:

1. Ask an affected user to try with browser extensions turned off, or on a different network.

2. If that fixes it, have their IT team allow the domains listed above.

A few notes:

• The name studio1 (in the storage.googleapis.com URLs) was the company’s original name and is therefore used for legacy reasons.