What are CSP errors?
Content Security Policy (CSP) is a security feature that controls which resources (like scripts or images) can be loaded on your website. If your site's CSP configuration is too restrictive, it can block resources from Intercom's domains.
This can disrupt key functionality and cause issues such as:
Blocked image uploads: Images cannot be loaded in Product Tours or the Messenger.
Unresponsive Product Tours: Changes made to a Product Tour fail to save.
Broken visuals: Intercom components, like logos, may appear as broken images.
Identify CSP errors
To confirm that CSP is causing issues with Intercom on your site, you'll need to check your browser's developer console.
Open the developer tools in your browser (typically by pressing F12 or right-clicking and selecting Inspect).
Navigate to the Console tab.
Reproduce the issue on your site, for example, by trying to upload an image or save a Product Tour.
Look for red error messages in the console indicating a CSP violation. These messages often mention blocked requests to Intercom domains (e.g.,
uploads.intercomcdn.com,*.intercom.io) and the specific CSP directive that caused the block, such asconnect-srcorimg-src.
Resolve CSP errors
To resolve these errors, you'll need to update your site's CSP configuration to allow resources from Intercom's required domains.
1. Update your CSP directives
Locate the error directive: In the developer console error, identify which directive caused the restriction (e.g.,
img-src).Whitelist Intercom domains: Add the required Intercom URLs to the relevant directives in your site's CSP configuration.
Important: You will typically need to add Intercom's domains to the following directives:
connect-src: For core functionalities.img-src: For images and attachments.media-src: For media resources.
The domains to add are *.intercomcdn.com and *.intercom.io. For the most up-to-date domain list, always consult Intercom's official documentation.
2. Revise security headers
Overly restrictive headers like X-Frame-Options or CSP frame-ancestors settings can also impact Intercom’s functionality. Review these settings and adjust them as needed.
3. Check network settings
Ensure your network or firewall settings allow outbound connections to Intercom's servers. You may need to ask your IT team to whitelist the necessary domains.
4. Test your changes
After updating your CSP configuration:
Reload the affected pages on your site and check if the Intercom features now function correctly.
Monitor the developer console to ensure no new CSP violations appear.
Note: Your development team or IT department may need to assist in implementing these CSP updates.
Need more help? Get support from our Community Forum
Find answers and get help from Intercom Support and Community Experts