https://csp-guide.com/tags/tidio/ Recent content in Tidio on CSP Guide Hugo -- gohugo.io en-us Sun, 09 Aug 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-tidio-live-chat/ Sun, 09 Aug 2026 00:00:00 +0000 https://csp-guide.com/posts/csp-for-tidio-live-chat/ <p>Tidio is one of those integrations that looks trivial until your CSP blocks half of it.</p> <p>You paste the widget snippet, refresh, and the chat bubble never appears. Then DevTools starts yelling about <code>script-src</code>, <code>connect-src</code>, <code>frame-src</code>, maybe <code>img-src</code>, and sometimes even <code>style-src</code>. If your site already has a reasonably locked-down policy, Tidio will force you to be explicit.</p> <p>I’ve had better results treating chat widgets like mini-applications instead of “just another script”. They load scripts, open WebSocket connections, render frames, fetch images, and inject styles. Your CSP has to allow that behavior without turning into <code>default-src * 'unsafe-inline' 'unsafe-eval'</code>.</p>