> For the complete documentation index, see [llms.txt](https://mazingxr.gitbook.io/mazing-world/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mazingxr.gitbook.io/mazing-world/integration-types/additional-information/content-security-policy.md).

# Content-Security Policy

## ❗️What is this about?

Some websites implement a **Content Security Policy** – a browser security feature that controls which domains are allowed to load certain types of content, such as iFrames, scripts, or images.

When our iFrame is embedded on a website **without proper allowlisting**, it can be blocked by the browser, resulting in an error like:

{% hint style="danger" %}
Refused to frame '' because it violates the following Content Security Policy directive: "frame-src ..."
{% endhint %}

## ✅ What you need to do

If you are seeing this error and our iFrame is not loading correctly, it is likely because your website’s CSP is **not allowing `mazing.link` as a valid `frame-src` domain**.

To fix this, you or your developer need to **add the following domain to your CSP allowlist**:

{% hint style="info" %}
\*.mazing.link
{% endhint %}

## 💡 Example

If your current CSP looks like this:

{% hint style="danger" %}
Content-Security-Policy: frame-src self  \*.google.com;
{% endhint %}

It should be updated to include:

{% hint style="success" %}
Content-Security-Policy: frame-src self \*.google.com \*.mazing.link;
{% endhint %}

## 📌 Why is this important?

Without this change, your browser will **refuse to load the 3D/AR iFrame**, and your visitors won’t see the interactive content. This issue often goes unnoticed unless developers check the browser console.