Does Wootric have a CSP?
Yes! Wootric implements a Content Security Policy to help protect against cross-site scripting (XSS) and other code injection attacks. Our CSP is designed to ensure that only trusted sources can load resources (like scripts, styles, or fonts) when the Wootric survey is embedded in your website.
We test our in-app JavaScript SDK to work with the recommended guidelines of Content-Security-Policy (CSP).
Why is this important for you?
If your website also has a strict CSP, you might need to adjust it to allow the Wootric domain (e.g., https://*.wootric.com;) for scripts, styles, or AJAX calls. This ensures our surveys load correctly while maintaining security.
What do we need to do?
Please note that configuring your CSP is an optional setting that may not apply in most cases. Please consult your IT manager to determine if you need to be concerned with it.
If you’re running into CSP-related issues, you'll need to add our Content Security Policy (CSP) headers into your website.
(for developers you can use this website to evaluate your CSP https://csp-evaluator.withgoogle.com/ )
Questions about Content Security Policy (CSP)? Please ask technical support here or email support@inmoment.com. 👩💻