If your website uses a content security policy (CSP), it needs to allow the chat widget to connect to us. If it doesn't, the widget can look normal but your customers' messages will never reach your AI agent or your team.

Many sites have no CSP, and in that case there is nothing to do. If you aren't sure, ask whoever manages your website or storefront theme.

What to add

Add both of these to the connect-src directive of your CSP:

<https://app.shippedapp.co>
wss://app.shippedapp.co

The second line, which starts with wss://, is the important one. It is the live chat connection. Allowing https://app.shippedapp.co alone is not enough, because browsers treat https:// and wss:// as separate permissions.

For example, a connect-src directive that already lists other services would become:

connect-src 'self' <https://app.shippedapp.co> wss://app.shippedapp.co <your existing entries>;

Leave your other entries as they are.

Where your CSP lives

A CSP is usually set in one of two places:

• A response header called Content-Security-Policy, set by your hosting platform, CDN or server. This is common on headless storefronts.

• A meta tag in your site's HTML or theme, such as <meta http-equiv="Content-Security-Policy" content="...">.

If both are present, the chat widget has to be allowed in both.

How to tell if your CSP is blocking chat

• The widget opens and the customer can type, but no reply ever arrives, and nothing shows up for your agents.

• In the browser's developer tools, the Console shows an error like Refused to connect to 'wss://app.shippedapp.co/widget-cable' because it violates the following Content Security Policy directive: "connect-src ...".

If you see either one, add the entries above and reload the page to test again.

Before you go live

If your site has a CSP, please make this change before your chat widget is turned on or updated, and tell your onboarding manager once it is live. We will confirm the connection on your site before switching anything over.