# How to embed Razorpay subscription button with CSP restrictions

**URL:** https://meta.discourse.org/t/how-to-embed-razorpay-subscription-button-with-csp-restrictions/372660
**Category:** Support
**Created:** [July 2, 2025, 5:03pm UTC](https://meta.discourse.org/t/how-to-embed-razorpay-subscription-button-with-csp-restrictions/372660 "2025-07-02T17:03:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![MihirR](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mihirr/32/475158_2.png) [@MihirR](https://meta.discourse.org/u/MihirR)
#### Post date: [July 2, 2025, 5:03pm UTC](https://meta.discourse.org/t/how-to-embed-razorpay-subscription-button-with-csp-restrictions/372660/1 "2025-07-02T17:03:53Z")

</div>

I just created a simple static page for subscriptions and now want to embed a button on that page.

For which the code is:

```html
<form>
    <script
        src="https://cdn.razorpay.com/static/widget/subscription-button.js"
        data-subscription_button_id="pl_randodmdi7373737"
        data-button_theme="brand-color"
        async>
    </script>
</form>

```

So from what I know the CSP won’t let me use the script, is there any way this could be possible?

PS: I’m using Landing Page Plug-in for the custom page.

---

<div class="post-metadata">

### Author: ![awesomerobot](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/awesomerobot/32/142900_2.png) [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [July 2, 2025, 5:21pm UTC](https://meta.discourse.org/t/how-to-embed-razorpay-subscription-button-with-csp-restrictions/372660/2 "2025-07-02T17:21:07Z")

</div>

This may help

> [@Can't get script tag to work in landing pages plugin due to content-security-policy](https://meta.discourse.org/t/cant-get-script-tag-to-work-in-landing-pages-plugin-due-to-content-security-policy/372200/4):
>
> Do you see an error concerning the script in your browser console? something like this?
> 
> ![A red error message in a web browser details a security policy violation preventing inline script execution, referencing directives and required keywords like 'unsafe-inline' or a nonce for enabling the script. (Captioned by AI)](https://global.discourse-cdn.com/meta/original/4X/1/6/f/16f0b2e6e7c2be9466c46d9e8618a95d45807c33.png)
> 
> You’ll want to add that provided hash (`'sha256-xxxxx'`) to the “content security policy script src” setting found in admin \> all site settings

and we have more information about CSP here [Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243)

---

<div class="post-metadata">

### Author: ![MihirR](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mihirr/32/475158_2.png) [@MihirR](https://meta.discourse.org/u/MihirR)
#### Post date: [July 3, 2025, 3:25am UTC](https://meta.discourse.org/t/how-to-embed-razorpay-subscription-button-with-csp-restrictions/372660/3 "2025-07-03T03:25:06Z")

</div>

```plaintext
Content security policy script src 

​
https://cdn.razorpay.com
Add item…

​
 content_security_policy_script_src: Value must be either 'unsafe-eval' or 'wasm-unsafe-eval', or in the form '<hash algorithm>-<base64 value>' where supported hash algorithms are sha256, sha384 or sha512. Ensure that your input is wrapped in single quotation marks.
Additional allowlisted script sources. The current host and CDN are included by default. See Mitigate XSS Attacks with Content Security Policy. (CSP). Other host sources are ignored as strict-dynamic is enabled.

```

This is the error I’m getting.

---

<div class="post-metadata">

### Author: ![awesomerobot](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/awesomerobot/32/142900_2.png) [@awesomerobot](https://meta.discourse.org/u/awesomerobot)
#### Post date: [July 3, 2025, 2:22pm UTC](https://meta.discourse.org/t/how-to-embed-razorpay-subscription-button-with-csp-restrictions/372660/4 "2025-07-03T14:22:20Z")

</div>

Right, that’s the error with the setting configuration in the admin area… after adding your script, what you want to look for is an error in your browser console (right click the page where the script should be loaded, select inspect, then navigate to the “console” tag)

In the console you should see an error similar to this:

 ![A red error message displays in a web browser, indicating that an inline script was refused to execute due to a violation of the Security Policy directive. (Captioned by AI)](https://global.discourse-cdn.com/meta/original/4X/1/6/f/16f0b2e6e7c2be9466c46d9e8618a95d45807c33.png)

This error provides either a hash or a nonce value which you then add to the admin “content security policy script src” setting